CVE-2026-1899

The Any Post Slider plugin for WordPress versions up to and including 1.0.4 contains a Stored Cross-Site Scripting vulnerability in its aps_slider shortcode. The post_type attribute lacks proper input sanitization and output escaping, enabling attackers to inject arbitrary web scripts.

To exploit this vulnerability, an attacker must be authenticated with at least Contributor-level access on the WordPress site. They can inject malicious script code via the shortcode attribute, which is then stored and executed when any user visits a page displaying the slider.

The impact includes execution of arbitrary JavaScript in the context of a logged-in user's session, potentially leading to session hijacking, site defacement, or redirection to malicious sites. The plugin has been temporarily closed as of April 6, 2026, pending a full review [1].