CVE-2026-14844
Received Received - Intake

Stored Cross-Site Scripting in Master Slider WordPress Plugin

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-14844
EUVD
EUVD-2026-83660

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
master_slider master_slider to 3.11.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Master Slider WordPress plugin versions up to 3.11.2. The plugin does not properly sanitize and escape certain shortcode attributes before outputting them in an inline script context. This allows users with the Contributor role or higher to inject malicious scripts that execute when the affected post is viewed.

Detection Guidance

Check if the Master Slider WordPress plugin version 3.11.2 or below is installed. Look for suspicious shortcode usage in posts or pages, particularly the ms_slider shortcode with untrusted attributes. Review user roles for Contributors or higher with editing access.

Impact Analysis

An attacker with Contributor access or higher could inject malicious scripts into posts. When other users view these posts, the scripts execute, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and reputational damage.

Mitigation Strategies

Restrict the Contributor role to trusted users only. Deactivate the Master Slider plugin if possible. Alternatively, block the ms_slider shortcode for non-Editor roles using a shortcode-restriction plugin until a fixed version is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart