CVE-2026-8900

Name of the Vulnerable Software and Affected Versions Simple SEO Slideshow versions prior to 1.2.9

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Because WordPress KSES does not strip malicious shortcode attribute values during the post-saving process, these payloads persist and execute for any visitor who accesses the page, including administrators reviewing the content.

Recommendations Update to a version later than 1.2.8.