CVE-2026-14844 Master Slider CVE debrief

Who should care

Site owners and administrators using the Master Slider WordPress plugin through 3.11.2 should assess exposure and take defensive actions to prevent exploitation. This includes restricting the Contributor role to trusted users, deactivating the plugin, or blocking the ms_slider shortcode for roles below Editor. Security teams and vulnerability management teams should review the vulnerability and provide guidance on mitigation and remediation.

Why it matters

CVE-2026-14844 is a Stored Cross-Site Scripting vulnerability in the Master Slider WordPress plugin through 3.11.2. Users with the Contributor role and above can perform attacks that execute when the affected post is viewed. Site owners should restrict the Contributor role to trusted users or deactivate the plugin. Those who need to keep it active can block the ms_slider shortcode for roles below Editor.

• Potential for Stored Cross-Site Scripting attacks
• Risk of code execution on affected posts
• Need for immediate mitigation or workaround
• Verification of plugin version and user roles required

Technical summary

The Master Slider WordPress plugin through 3.11.2 does not sanitize and escape some of its shortcode attributes before outputting them in an inline script context. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. The vulnerability has not been patched, and site owners should take defensive actions to prevent exploitation. Official sources confirm the vulnerability and provide guidance on mitigation and workarounds. Affected systems should be reviewed for exposure, and compensating controls may be necessary.

Defensive priority

Site owners should restrict the Contributor role to trusted users or deactivate the Master Slider WordPress plugin through 3.11.2. Those who need to keep it active can block the ms_slider shortcode for roles below Editor.

Recommended defensive actions

• Restrict the Contributor role to trusted users
• Deactivate the Master Slider WordPress plugin through 3.11.2
• Block the ms_slider shortcode for roles below Editor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows Stored Cross-Site Scripting attacks due to unsanitized and unescaped shortcode attributes in the Master Slider WordPress plugin through 3.11.2. Evidence is based on CVE Program and NVD records. Affected scope and severity are confirmed by official sources. Defenders should verify plugin version and user roles, and consider restricting the Contributor role or deactivating the plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.