CVE-2026-8866

The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides_handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/jquery-googleslides/tags/1.3/init.php#L39
• https://plugins.trac.wordpress.org/browser/jquery-googleslides/tags/1.3/init.php#L52
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8e363d-60ec-4e86-856c-c4ffc11fe690?source=cve

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8858IBM WebSphere Application Server and IBM WebSphere Applicati…8.8
• CVE-2026-8859IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow a…9.9
• CVE-2026-8861IBM Security Verify could allow a remote attacker to obtain …5.3
• CVE-2026-8863Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerab…7.8
• CVE-2026-8864The HP Fan Control App might allow local escalation of privi…7.3
• CVE-2026-8865The Avalon23 Products Filter for WooCommerce plugin for Word…6.4
• CVE-2026-8867The Post Category Gallery plugin for WordPress is vulnerable…6.4
• CVE-2026-8868The Single Mailchimp plugin for WordPress is vulnerable to S…6.4
• CVE-2026-8869The Mutual Funds Data plugin for WordPress is vulnerable to …6.4
• CVE-2026-8870The Team Master – A Modern WordPress Team Showcase plugin fo…6.4
• CVE-2026-8871The Formidable Kinetic plugin for WordPress is vulnerable to…6.4
• CVE-2026-8872The Animate Your Content plugin for WordPress is vulnerable …6.4