CVE-2026-4076

The Slider Bootstrap Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'category' and 'template' shortcode attributes in all versions up to and including 1.0.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin uses extract() on shortcode_atts() to parse attributes, then directly outputs the $category variable into multiple HTML attributes (id, data-target, href) on lines 38, 47, 109, and 113 without applying esc_attr(). Similarly, the $template attribute flows into a class attribute on line 93 without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L109
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L113
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L38
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L47
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L7
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/tags/1.0.7/includes/sbc-shortcode.php#L93
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L109
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L113
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L38
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L47
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L7
• https://plugins.trac.wordpress.org/browser/slider-bootstrap-carousel/trunk/includes/sbc-shortcode.php#L93
• https://www.wordfence.com/threat-intel/vulnerabilities/id/26fe0b7b-dbf8-467f-b5e2-86a858eeaf89?source=cve

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40754Unauthenticated PHP Object Injection in Roisin <= 1.4 versio…8.1
• CVE-2026-40755Unauthenticated PHP Object Injection in TechLink <= 1.3 vers…8.1
• CVE-2026-40756Unauthenticated PHP Object Injection in Zoya <= 1.4 versions…8.1
• CVE-2026-40757Unauthenticated PHP Object Injection in Château <= 1.2.1 ver…8.1
• CVE-2026-40758Unauthenticated PHP Object Injection in Léonie <= 1.2.1 vers…8.1
• CVE-2026-40759Unauthenticated PHP Object Injection in Esmée <= 1.4 version…8.1
• CVE-2026-40760Unauthenticated PHP Object Injection in Behold <= 1.5 versio…8.1
• CVE-2026-40761Unauthenticated PHP Object Injection in Valeska <= 1.2.2 ver…8.1
• CVE-2026-40762Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions…7.5
• CVE-2026-40763Missing Authorization vulnerability in WP Royal Royal Elemen…5.3
• CVE-2026-40764Cross-Site Request Forgery (CSRF) vulnerability in Syed Balk…8.1
• CVE-2026-40765Unauthenticated Cross Site Scripting (XSS) in collectchat <=…7.1