CVE-2026-1275: WordPress Multi Post Carousel XSS Flaw

CVE-2026-1275 Overview

CVE-2026-1275 is a Stored Cross-Site Scripting (XSS) vulnerability in the Multi Post Carousel by Category plugin for WordPress, affecting all versions up to and including 1.4. The flaw resides in the post_slides_shortcode function, which fails to sanitize the user-supplied slides shortcode attribute and does not escape it on output. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The issue is categorized under CWE-79.

Critical Impact
Authenticated contributors can store arbitrary JavaScript in WordPress pages, enabling session theft, administrative action hijacking, and client-side redirection.

Affected Products

Multi Post Carousel by Category plugin for WordPress, all versions through 1.4
WordPress sites that allow Contributor-level or higher account registration
Sites using the [post_slides] shortcode in published content

Discovery Timeline

2026-03-21 - CVE-2026-1275 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1275

Vulnerability Analysis

The Multi Post Carousel by Category plugin registers a shortcode handler named post_slides_shortcode that builds carousel markup from shortcode attributes. The slides attribute, intended to control the number of slides shown, is rendered into the HTML response without proper sanitization or escaping. As a result, any string supplied through [post_slides slides="..."] is reflected directly into the page DOM.

WordPress permits Contributor-level accounts to author posts that contain shortcodes. Because the plugin trusts the attribute value, a contributor can embed JavaScript payloads inside the slides parameter. The payload is stored as part of the post content and executes when any visitor — including administrators previewing or moderating the post — loads the page.

The stored nature of the injection elevates impact beyond reflected XSS. A single malicious post can persist until detected and trigger across multiple victim sessions, including privileged ones.

Root Cause

The root cause is missing input sanitization on the slides shortcode attribute combined with absent output escaping when the value is concatenated into the rendered HTML. WordPress provides helper functions such as sanitize_text_field(), absint(), and esc_attr() that should be applied at the boundary, but the plugin invokes none of them on this parameter at line 174 of multi-post-carousel.php.

Attack Vector

Exploitation requires an authenticated session at the Contributor role or higher. The attacker authors a post containing a [post_slides] shortcode and supplies a JavaScript payload in the slides attribute. When the post is approved and viewed — or previewed by a higher-privileged editor — the script executes in the victim's browser under the site's origin. The scope change in the CVSS vector reflects that the injected script can act against resources beyond the vulnerable plugin, including the WordPress administrative interface. See the Wordfence Vulnerability Intelligence entry and the WordPress Plugin Source Code for technical detail.

Detection Methods for CVE-2026-1275

Indicators of Compromise

Post content containing [post_slides ...] shortcodes with slides attribute values that include <script>, onerror=, onload=, or javascript: strings.
Unexpected outbound browser requests from logged-in administrator sessions to attacker-controlled domains shortly after viewing posts authored by low-privilege users.
New WordPress administrator accounts or modified user roles created without a corresponding admin login event.
Database entries in wp_posts.post_content containing encoded payloads such as HTML entities or Base64 strings embedded in carousel shortcodes.

Detection Strategies

Query the WordPress database for posts containing [post_slides and inspect the slides attribute for HTML tag characters or event handlers.
Monitor browser console errors and Content Security Policy violation reports for inline-script blocks originating from post content.
Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from Contributor accounts immediately followed by anomalous admin actions.

Monitoring Recommendations

Forward WordPress audit logs and web server telemetry to a centralized analytics tier such as Singularity Data Lake for correlation across authentication, content-edit, and outbound network events.
Alert on Contributor-role accounts that submit posts containing shortcode attributes with HTML or script syntax.
Track administrative session activity following the viewing of unpublished or pending posts to identify post-XSS account takeover.

How to Mitigate CVE-2026-1275

Immediate Actions Required

Deactivate the Multi Post Carousel by Category plugin until a patched release is verified and installed.
Audit the wp_posts table for existing [post_slides] shortcodes and review any that contain non-numeric slides values.
Restrict Contributor-level registration where it is not operationally required, and review existing Contributor accounts for legitimacy.
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Versions through 1.4 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for an updated release that applies sanitize_text_field() or absint() to the slides attribute and esc_attr() on output.

Workarounds

Remove the plugin from production sites and replace the shortcode with a maintained carousel plugin.
Apply a Web Application Firewall rule that blocks [post_slides shortcode submissions containing <, >, or javascript: substrings.
Deploy a strict Content Security Policy that disallows inline scripts, reducing the impact of injected payloads.
Demote untrusted Contributor accounts or require editor review of all shortcode-containing posts before publication.

bash

# Temporary mitigation: disable the plugin via WP-CLI
wp plugin deactivate multi-post-carousel

# Identify suspect shortcodes in the database
wp db query "SELECT ID, post_author, post_status FROM wp_posts \
  WHERE post_content LIKE '%[post_slides%' \
  AND post_content REGEXP '(<script|onerror=|onload=|javascript:)';"