Description

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-22T06:16:14.833Z",
  "pubdate": "2026-08-22T06:16:14.833Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability has been identified in The Post Grid, Slider & Carousel Ultimate WordPress plugin affecting versions prior to 1.8.1. The flaw stems from insufficient input sanitization and output escaping of custom post type settings rendered within HTML attributes on the administrative edit screen. This security deficiency allows malicious actors possessing the Contributor role and above to inject arbitrary JavaScript payloads into the application state. When an administrative user accesses the affected custom post item within the WordPress administration panel, the injected script executes within their active administrative session, inheriting their elevated privileges. The potential impact of this exploitation includes unauthorized administrative actions, privilege escalation within the application, data exfiltration, or complete site compromise depending on the capabilities of the victim's session. Successful exploitation requires authenticated access with at least Contributor privileges and relies on social engineering or standard editorial workflows to entice an administrator to view the maliciously crafted custom post type setting.",
  "technicalDetails": "The vulnerability resides in the custom post type settings management functionality of The Post Grid, Slider & Carousel Ultimate plugin prior to version 1.8.1. The root cause of the issue is the failure of the application to properly sanitize user-supplied input and contextually escape data before rendering it directly into an HTML attribute on the admin edit screen. Because the application blindly trusts the stored input retrieved from the database, malicious payloads injected via custom post type settings are rendered raw into the Document Object Model (DOM).\nAn attacker possessing the Contributor role—which typically permits the creation and submission of posts for review—can manipulate custom post type settings to include malicious JavaScript payloads, such as event handler attributes or script tags engineered to break out of the intended HTML attribute context. The attack flow proceeds as follows: First, the authenticated attacker creates or edits a custom post within the vulnerable plugin, inserting the malicious payload into the vulnerable setting field. Second, the payload is persistently stored in the WordPress database without adequate sanitization. Third, an unsuspecting user with the Administrator role navigates to the admin edit screen and opens the specific item containing the poisoned setting. Fourth, the server outputs the unsanitized setting directly into an HTML attribute within the administrative interface. Finally, upon rendering the page, the browser parses and executes the embedded JavaScript in the context of the administrator's active session.\nThe attack vector is local to the administrative dashboard, requiring network access to the WordPress backend and valid credentials granting a minimum of Contributor-level privileges. The payload behavior is constrained by the permissions of the victim administrator, allowing the execution of arbitrary script logic that can interact with the WordPress REST API, create rogue administrator accounts, install or modify plugins and themes, or perform other sensitive state-changing operations via the browser."
}