CVE-2026-8900
Stored XSS in Simple SEO Slideshow WordPress Plugin
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simple_seo_slideshow | plugin | to 1.2.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Simple SEO Slideshow plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.2.8. This vulnerability arises because the plugin does not properly sanitize or escape input in shortcode attributes.
Authenticated users with contributor-level access or higher can inject malicious scripts into pages via shortcode attributes. These scripts are stored and then executed whenever any user, including administrators, views the affected page.
The issue exists because WordPress KSES, the filtering mechanism, does not remove malicious shortcode attribute values when a post is saved, allowing the malicious payloads to persist.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access to inject arbitrary web scripts into WordPress pages.
When other users, including administrators, visit the infected pages, the malicious scripts will execute in their browsers. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser.
Because the vulnerability requires only contributor-level access, it can be exploited by relatively low-privileged users, increasing the risk of compromise.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Simple SEO Slideshow plugin for WordPress to a version later than 1.2.8 where the issue is fixed.
Additionally, restrict contributor-level access or review posts created by contributors for malicious shortcode attributes to prevent stored cross-site scripting payloads.