CVE-2026-4859

Name of the Vulnerable Software and Affected Versions SP Blog Designer versions prior to 1.0.1

Description The SP Blog Designer plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the 'design' attribute of the wpsbd post carousel shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.0.0. As a temporary workaround, restrict the use of the wpsbd post carousel shortcode or its design attribute for users with Contributor-level access.