CVE-2026-5340

Name of the Vulnerable Software and Affected Versions Fancy Image Show versions prior to 9.2

Description Stored Cross-Site Scripting occurs via the fancy-img-show shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update the plugin to a version newer than 9.1.