Slideshow Gallery LITE CVE-2026-2021

Exploitation requires a valid WordPress account with at least Contributor-level privileges on the target site - anonymous, unauthenticated attackers cannot exploit this vulnerability. The Slideshow Gallery LITE plugin must be installed, activated, and shortcode rendering must be available to Contributor-level users (default WordPress behavior). The specific condition is use of the 'alwaysauto' attribute on the plugin's shortcode in post or page content. Impact delivery requires a victim user (any role, including administrator) to browse to a page or post containing the injected shortcode. Limiting factors: (1) Contributor access must be obtained or held legitimately, (2) the plugin must be actively deployed, (3) a victim must visit the affected content - passive stored injection, but requires a browsing event for script execution.

The NVD-assigned CVSS 3.1 score of 6.4 (Medium) reflects the network attack vector, low complexity, and scope change - but the low-privilege requirement (PR:L, Contributor role) is the primary limiting factor. In practice, Contributor access is a non-trivial barrier on hardened WordPress sites; however, many WordPress deployments grant Contributor roles freely to guest authors or community members, making this exploitable in a meaningful subset of real deployments. The scope change (S:C) elevates real-world impact: a successful injection targeting an administrator's session could result in full site compromise, upgrading the effective impact beyond the base score suggests. No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. KEV status is absent and no public POC has been identified, suggesting no confirmed widespread exploitation at time of analysis. The presence of a Trac changeset (3567787) in the references indicates the maintainer has addressed the flaw, which reduces urgency for sites running patched versions. The UI:N metric in the provided CVSS vector is debatable for stored XSS - victim browser execution inherently requires a user to visit the page - but NVD's convention of scoring UI:N for stored XSS (attacker side requires no interaction) has been applied here. This is a real priority for multi-author WordPress sites with untrusted contributors, but lower risk for single-author or admin-only sites.

An attacker with a Contributor-level WordPress account - obtained through open registration, social engineering, or credential compromise - edits or creates a post containing the Slideshow Gallery shortcode with a crafted JavaScript payload embedded in the 'alwaysauto' attribute. The malicious post is published or submitted for review; when any authenticated user (including an administrator) subsequently views the page, the injected script executes in their browser, potentially stealing the session cookie and granting the attacker full administrative control of the WordPress site. No public proof-of-concept code has been identified at time of analysis, but the vulnerability class (unsanitized shortcode attribute → HTML output) is well understood and trivially exploitable by anyone familiar with WordPress development.