CVE-2026-2021: Slideshow Gallery LITE WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-2021 is a Stored XSS vulnerability in Slideshow Gallery LITE (WordPress plugin) versions ≤1.8.5. The vulnerability exists in the handling of the 'alwaysauto' shortcode attribute, where insufficient input sanitization and output escaping allow authenticated attackers with Contributor role or above to inject arbitrary JavaScript. The injected payload persists in the database and executes in the context of any user's session who views the affected page, bypassing the same-origin policy due to the stored nature of the attack. The CVSS v3.1 score of 6.4 (MEDIUM) reflects network accessibility, low privilege requirements, and cross-site impact with limited confidentiality and integrity consequences.

Business impact

This vulnerability enables privilege escalation and account compromise within WordPress environments. A malicious contributor can deface content, steal session cookies or credentials from administrators, redirect users to phishing sites, or inject cryptominers into pages. For multi-user WordPress sites or those accepting external contributors, the risk extends to audience trust and potential regulatory exposure if sensitive user data is harvested. Remediation delays increase the window during which visitors remain exposed.

Affected systems

Slideshow Gallery LITE plugin for WordPress, all versions up to and including 1.8.5. This affects any WordPress installation where the plugin is installed and activated, regardless of WordPress version. The vulnerability requires an attacker to have authenticated access with at least Contributor-level permissions, which may come from legitimate user accounts, compromised credentials, or intentional plugin access grants.

Exploitability

Exploitation requires prior authentication and contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities. However, contributor access is commonly granted to content creators, freelancers, and external authors in multi-user WordPress environments. Once an attacker injects a payload via the vulnerable 'alwaysauto' shortcode attribute, no further interaction is required—the script executes automatically whenever any user views that page. This makes the attack reliable and high-impact within its privilege scope.

Remediation

Update the Slideshow Gallery LITE plugin to a patched version released after June 18, 2026. Verify the specific version number and availability in the WordPress plugin repository or the vendor's advisory. If an update is not yet available or applicable, immediately review and restrict contributor-level access to only trusted users, audit existing pages and posts for suspicious shortcode attributes, and consider disabling the plugin temporarily until a fix is confirmed.

Patch guidance

Check the WordPress plugin repository or Slideshow Gallery LITE's official support channels for an available update addressing CVE-2026-2021. Patches released after the publication date of June 18, 2026 should include input sanitization and proper output escaping for shortcode attributes. Test patches in a staging environment before deploying to production. Verify patch effectiveness by confirming that the 'alwaysauto' attribute no longer allows unescaped script injection. If the vendor has not released a patch, escalate to the plugin maintainer or consider alternative gallery plugins with active security maintenance.

Detection guidance

Search your WordPress database for posts and pages containing the 'alwaysauto' shortcode attribute with suspicious or obfuscated content (e.g., encoded JavaScript, onclick handlers, or script tags embedded within attribute values). Review WordPress user activity logs for contributor accounts creating or modifying pages immediately before user complaints or anomalies. Monitor page source code and browser console for unexpected script execution. Use WordPress security plugins with shortcode auditing capabilities to scan for malicious payloads. Check for signs of session hijacking or unauthorized administrative actions correlating with the vulnerability publication date.

Why prioritize this

While the CVSS score is MEDIUM (6.4), the vulnerability deserves prompt attention because it enables persistent, silent compromise of page content across multiple user sessions. In collaborative WordPress environments, the barrier to exploitation is low—many sites legitimately grant contributor access. The stored XSS nature means the attack is not easily reversible without database cleanup. Organizations with multi-author sites, external contributors, or those hosting sensitive content should prioritize patching to maintain user trust and prevent account compromise. Not on CISA KEV, but that does not diminish its risk in affected environments.

Risk score, explained

CVSS 6.4 reflects: (1) Network-based attack vector accessible to any authenticated user; (2) Low complexity requiring only shortcode injection with no race conditions or timing constraints; (3) Low privilege requirements (Contributor-level is common); (4) Cross-site impact (scripts execute in other users' contexts); (5) Limited confidentiality and integrity impact (no direct data exfiltration, but credential/session theft possible). Confidentiality and integrity are scored as Low rather than High because the vulnerability alone does not guarantee access to system or user data—it depends on attacker intent. Availability impact is None. The MEDIUM severity appropriately balances the ease of exploitation against its scope and typical impact in WordPress deployments.

Frequently asked questions