MEDIUM
zayedbaloch
CVE published 2026-10-03
CVE-2026-92767
The Twenty20 Image Before-After plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute when a user accesses an injected page.