CVE-2026-8873

Vulnerability

The Content Slideshow plugin for WordPress (versions up to and including 2.4.1) contains a stored cross-site scripting vulnerability in its shortcode attributes. The content_slideshow_get_embed function in slideshow-widget-shortcode.php [1][2] fails to properly sanitize user-supplied attributes such as size, year, month, mode, and captions, allowing injection of malicious web scripts.

Exploitation

An authenticated attacker with at least Contributor-level access can insert a shortcode (e.g., [content_slideshow captions="") into a post or page. The injected script is stored in the database and executes whenever a user accesses the affected page. No additional user interaction beyond visiting the page is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, redirection to malicious sites, or theft of sensitive information. The attack is stored, so every visitor to the compromised page is affected.

Mitigation

No official patch has been released in the available references [1][2]. As a workaround, site administrators should restrict the contributor role from using shortcodes or disable the plugin entirely until a security update is available.