WordPress Plugin Vulnerabilities

Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

Description

The plugin does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

Proof of Concept

Affects Plugins

Plugin icon
post-grid-carousel-ultimate
Fixed in 1.8.1

References

CVE
CVE-2026-16260

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
87c95831-d1b4-42b2-8fc7-6cba60fca400

Timeline

Publicly Published
2026-08-20 (about 2 days ago)
Added
2026-08-20 (about 1 day ago)
Last Updated
2026-08-20 (about 1 day ago)

Other

Published
Title
Published
2024-08-16
Title
WP Telegram Widget and Join Link < 2.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-04-13
Title
WholeSale Products Dynamic Pricing Management WooCommerce < 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Published
2023-04-28
Title
Maintenance Switch < 1.6.3 - Reflected XSS
Published
2026-04-21
Title
Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2026-03-17
Title
WP Go Maps (formerly WP Google Maps) < 10.0.06 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings