Medium severity6.8NVD Advisory· Published Aug 22, 2026· Updated Aug 26, 2026
CVE-2026-16260
CVE-2026-16260
Description
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.8.1
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)Wordfence Blog · Aug 27, 2026