Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute

An authenticated attacker with at least Contributor-level access can inject a malicious `alwaysauto` attribute value into the `[slideshow]` shortcode when creating or editing a post. Because the plugin fails to sanitize and escape this attribute, the injected JavaScript is stored in the database and executed in the browsers of any user who views the affected page. This is a classic Stored Cross-Site Scripting (XSS) attack [CWE-79].

The vulnerability resides in the `embed()` method of the `SlideshowGallery` class (registered as the `[slideshow]` and `[tribulant_slideshow]` shortcode handlers). The `alwaysauto` shortcode attribute is not sanitized or escaped before being output, allowing stored XSS.

The advisory states that the vulnerability is due to insufficient input sanitization and output escaping on user-supplied attributes. The patch (version 1.8.6) should apply proper sanitization and escaping to the `alwaysauto` attribute before it is rendered. Without the patch, an attacker can inject arbitrary HTML and JavaScript via this attribute.