EUVD-2026-14171
GHSA-9479-m26h-g85h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the post_slides_shortcode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Multi Post Carousel by Category WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'slides' shortcode attribute due to insufficient input sanitization and output escaping in the post_slides_shortcode function. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code into pages, and the malicious script will execute whenever any user visits the affected page. With a CVSS score of 6.4 and confirmed vulnerability across all versions up to and including 1.4, this represents a moderate-risk vulnerability primarily affecting WordPress sites using this plugin.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where user-supplied input is not properly sanitized before being rendered in HTML context. The affected product, identified via CPE as cpe:2.3:a:gbsdeveloper:multi_post_carousel_by_category:*:*:*:*:*:*:*:*, is a WordPress plugin that processes shortcode attributes. The vulnerable code path exists in the post_slides_shortcode function at line 174 of the plugin's main file, where the 'slides' parameter is accepted directly from shortcode markup without applying WordPress sanitization functions (such as sanitize_text_field or wp_kses_post) or proper output escaping (such as esc_attr or wp_json_encode). This allows attackers to bypass the plugin's processing and inject script tags or event handlers that execute in the browser context of users viewing the page.
RemediationAI
The primary remediation is to update the Multi Post Carousel by Category plugin to a version after 1.4 that includes patched sanitization and output escaping. WordPress administrators should immediately upgrade the plugin through the WordPress admin dashboard (Plugins > Installed Plugins > Multi Post Carousel by Category > Update) or download the latest version from https://plugins.trac.wordpress.org/browser/multi-post-carousel/trunk/multi-post-carousel.php#L174. Until patching is possible, administrators should restrict Contributor-level access to only trusted users and audit existing posts and pages using the '[post_slides]' shortcode for any suspicious injected content, removing any pages with untrusted shortcode attributes. Additionally, implementing a Web Application Firewall (WAF) rule to detect and block script injection patterns in shortcode attributes can provide temporary mitigation.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today