PT-2026-95913 · WordPress · Master Slider
CVE-2026-14844
·
Published
2026-09-20
·
Updated
2026-09-24
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Master Slider WordPress plugin versions prior to 3.11.3
Description
Insufficient sanitization and escaping of shortcode attributes before they are output in an inline script context allows users with the Contributor role and above to perform Stored Cross-Site Scripting (XSS) attacks. These attacks execute when a viewing user opens the affected post.
Recommendations
Restrict the Contributor role to trusted users.
Deactivate the plugin.
Block the
ms slider shortcode for roles below Editor.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Master Slider