CVE-2026-2021

The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, and including, 1.8.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/slideshow-gallery/tags/1.8.5/slideshow-gallery.php#L558
• https://plugins.trac.wordpress.org/browser/slideshow-gallery/tags/1.8.5/views/default/gallery.php#L192
• https://plugins.trac.wordpress.org/browser/slideshow-gallery/trunk/slideshow-gallery.php#L558
• https://plugins.trac.wordpress.org/browser/slideshow-gallery/trunk/views/default/gallery.php#L192
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3567787%40slideshow-gallery&new=3567787%40slideshow-gallery&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/55d842fc-a750-4b59-a1d6-b3bd427dfe79?source=cve

Published

Jun 18, 2026

Last Modified

Jun 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20202In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, …6.6
• CVE-2026-20203In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, …4.3
• CVE-2026-20204In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, …7.1
• CVE-2026-20205In Splunk MCP Server app versions below 1.0.3 , a user who h…7.2
• CVE-2026-20206A vulnerability in the BrowserBot component of Cisco Thousan…6.3
• CVE-2026-20209A vulnerability in the web UI of Cisco Catalyst SD-WAN Manag…5.4
• CVE-2026-20210A vulnerability in the web UI of Cisco Catalyst SD-WAN Manag…5.4
• CVE-2026-20213A vulnerability in the PE file format parser of ClamAV could…7.5
• CVE-2026-20214A vulnerability in the FSG file format parser of ClamAV coul…7.5
• CVE-2026-20215A vulnerability in the 7z file format parser of ClamAV could…7.5
• CVE-2026-20216A vulnerability in the InstallShield file format parser of C…7.5
• CVE-2026-20217A vulnerability in the PESpin file format parser of ClamAV c…7.5