CVE-2026-8866

Name of the Vulnerable Software and Affected Versions jQuery googleslides plugin for WordPress versions prior to 1.4

Description Stored Cross-Site Scripting occurs via the 'googleslides' shortcode. The issue stems from insufficient input sanitization and output escaping within the googleslides handler() function. Specifically, the function interpolates user-supplied attributes—userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed—directly into single-quoted HTML attributes without utilizing esc attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update the jQuery googleslides plugin for WordPress to version 1.4 or later.