CVE-2026-16260

UNKNOWN 0.0

Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

Vendor	unknown
Product	post grid, slider & carousel ultimate
Published	Aug 22, 2026

Stay Ahead of the Next One

Get instant alerts for unknown post grid, slider & carousel ultimate

Be the first to know when new unknown vulnerabilities affecting unknown post grid, slider & carousel ultimate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Post Grid, Slider & Carousel Ultimate

0 < 1.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/87c95831-d1b4-42b2-8fc7-6cba60fca400/

Credits

Yaswanth Reddy Sunkara WPScan