VULNERABILITY INTELLIGENCE
CVE-2026-16260
CVSS score6.8 MEDIUM
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-08-22
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Description
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79