PatchSiren cyber security CVE debrief
CVE-2026-8873 celloexpressions CVE debrief
A stored cross-site scripting (XSS) vulnerability exists in the Content Slideshow WordPress plugin, affecting all versions up to and including 2.4.1. The flaw stems from insufficient input sanitization and output escaping within shortcode attributes. Attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when users access the injected content. The vulnerability was disclosed on 2026-05-27 and carries a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in ransomware campaigns has been reported.
- Vendor
- celloexpressions
- Product
- Content Slideshow
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
WordPress site administrators using the Content Slideshow plugin, security teams managing WordPress installations, and developers maintaining plugins with shortcode functionality
Technical summary
The Content Slideshow plugin for WordPress fails to properly sanitize and escape input within shortcode attributes, enabling stored XSS attacks. The vulnerability exists in slideshow-widget-shortcode.php at lines 14 and 143 in version 2.4.1. Authenticated users with contributor privileges or higher can exploit this to inject malicious scripts that persist in page content and execute in victims' browsers. The attack requires no user interaction beyond viewing the compromised page, and the CVSS scope metric indicates a changed scope (S:C) due to the ability to affect resources beyond the vulnerable component.
Defensive priority
medium
Recommended defensive actions
- Update the Content Slideshow plugin to a version newer than 2.4.1 when available
- Review and remove any suspicious shortcode content added by contributor-level users
- Implement Content Security Policy headers to mitigate XSS impact
- Consider restricting contributor permissions until patching is complete
- Monitor access logs for unusual shortcode modifications
Evidence notes
The vulnerability is documented in the NVD record with references to specific source code locations in the plugin's shortcode implementation. Wordfence security research identified the insufficient sanitization at lines 14 and 143 of slideshow-widget-shortcode.php in version 2.4.1. The CWE-79 classification confirms the XSS nature of the weakness.
Official resources
2026-05-27