CVE-2026-15726

Name of the Vulnerable Software and Affected Versions Serious Slider versions prior to 1.4.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the theme attribute of the shortcode, which then execute when a user visits the affected page.

Recommendations Update Serious Slider to a version newer than 1.4.0. As a temporary mitigation, restrict the use of the theme attribute in shortcodes for users with contributor-level access.