Skip to content
Sign in
6.8 Medium

CVE-2026-16260 The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its…

Description

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

Affected products and versions

Product Affected versions Fixed in
Post Grid, Slider & Carousel Ultimate 1.8 earliest → < 1.8.1 1.8.1

Other CVEs of Post Grid, Slider & Carousel Ultimate

The 2 CVEs of Post Grid, Slider & Carousel Ultimate →
CVE-2022-1266 The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title,… Not rated
Track this CVE