CVE-2026-14844: Master Slider WordPress XSS Vulnerability

CVE-2026-14844 Overview

CVE-2026-14844 is a Stored Cross-Site Scripting (XSS) vulnerability in the Master Slider WordPress plugin through version 3.11.2. The plugin fails to sanitize and escape certain shortcode attributes before outputting them in an inline script context. Authenticated users with the Contributor role or higher can inject malicious JavaScript that executes when the affected post is viewed by other visitors. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers with Contributor-level access can persist arbitrary JavaScript in posts, enabling session theft, administrative account takeover, and drive-by browser attacks against site visitors.

Affected Products

Master Slider WordPress plugin versions through 3.11.2
WordPress sites permitting Contributor-or-higher registration with the plugin active
Any published post or page embedding the vulnerable ms_slider shortcode

Discovery Timeline

2026-09-20 - CVE-2026-14844 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-14844

Vulnerability Analysis

The Master Slider plugin exposes the ms_slider shortcode to WordPress authors. When a post containing this shortcode is rendered, the plugin emits an inline <script> block that reflects one or more shortcode attributes into JavaScript variables. The attribute values are not escaped for a JavaScript context, so an attribute crafted to break out of a string literal injects executable code into the page.

Because the injection lives in a stored post, the payload runs for every viewer, including administrators. An attacker with Contributor access can therefore pivot from a low-privilege account to full site compromise once an editor or administrator previews the post. Editorial workflows that automatically render draft previews expand the exposure window before publication review.

Root Cause

The root cause is missing context-aware output encoding. WordPress shortcode APIs deliver raw attribute strings to handler callbacks, and the plugin concatenates those strings directly into inline JavaScript without applying esc_js() or an equivalent JavaScript-safe encoder. Standard HTML entity encoding would not remediate this sink because the browser parses <script> contents as JavaScript rather than HTML.

Attack Vector

Exploitation requires an authenticated account holding at least the Contributor role and social interaction from a viewer who loads the affected post. The attacker inserts an ms_slider shortcode with a crafted attribute payload, saves the post, and waits for a higher-privileged user to view the content. Executed JavaScript runs in the victim's browser session and can exfiltrate cookies, mint new administrator accounts through the REST API, or install malicious plugins.

Detailed reproduction steps are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-14844

Indicators of Compromise

Post or page content containing ms_slider shortcode attributes with quote characters, angle brackets, or JavaScript keywords such as onerror, alert(, or fetch(
Unexpected outbound requests from visitor browsers to attacker-controlled domains shortly after loading pages that render Master Slider content
New WordPress administrator accounts, plugin installations, or option changes correlated with viewing an affected post

Detection Strategies

Query the wp_posts table for shortcode occurrences matching ms_slider and inspect attribute values for suspicious characters
Enable a Content Security Policy in report-only mode and monitor script-src violations tied to inline execution on pages using the plugin
Review WordPress user role assignments and audit the activity of any Contributor-level or Author-level accounts created recently

Monitoring Recommendations

Log and alert on privilege escalations, plugin installations, and administrative REST API calls originating from authenticated sessions
Monitor the WordPress plugin repository for a fixed release of Master Slider and subscribe to WPScan feed updates for this identifier
Instrument web application firewall telemetry to record request bodies posting to /wp-admin/post.php that contain ms_slider shortcodes

How to Mitigate CVE-2026-14844

Immediate Actions Required

Deactivate the Master Slider plugin on sites that accept Contributor-level registrations or expose editorial preview to untrusted users
Audit existing posts and drafts for ms_slider shortcodes and remove or sanitize attribute values that contain script-context metacharacters
Restrict the Contributor and Author roles to trusted personnel and revoke access from dormant accounts

Patch Information

No fixed version of Master Slider is available at the time of publication. Site owners should track vendor advisories and the WPScan Vulnerability Report for release information and apply the patched version as soon as it ships.

Workarounds

Block the ms_slider shortcode for roles below Editor using a shortcode-restriction plugin, which prevents exploitation without removing Master Slider entirely
Implement a strict Content Security Policy that disallows inline scripts on public-facing pages to neutralize the injection sink
Require editorial review before any Contributor-authored post is previewed or published by a higher-privileged user

bash

# Example: remove ms_slider shortcode access for low-privilege roles
# Add to a site-specific mu-plugin
add_action('init', function () {
    if (!current_user_can('edit_others_posts')) {
        remove_shortcode('ms_slider');
    }
}, 20);