Cross-site scripting in contrid Slideshow Gallery LITE
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, and including, 1.8.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2021
- 2026-10-03 Alias added: GHSA-5qqr-q6rw-943w
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/55d842fc-a750-4b59-a1d6-b3bd427dfe79?source=cve
- https://plugins.trac.wordpress.org/browser/slideshow-gallery/trunk/views/default/gallery.php#L192
- https://plugins.trac.wordpress.org/browser/slideshow-gallery/tags/1.8.5/views/default/gallery.php#L192
- https://plugins.trac.wordpress.org/browser/slideshow-gallery/trunk/slideshow-gallery.php#L558
- https://plugins.trac.wordpress.org/browser/slideshow-gallery/tags/1.8.5/slideshow-gallery.php#L558
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3567787%40slideshow-gallery&new=3567787%40slideshow-gallery&sfp_email=&sfph_mail=
More contrid vulnerabilities
- TI-2023-04414 Newsletter Lite < 4.9.3 - Admin+ Command Injection CVSS 3.1HIGH 7.2
- TI-2014-04458 Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before… CVSS 2.0MEDIUM 6.5
- TI-2018-14949 The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. CVSS 3.0CRITICAL 9.8
- TI-2018-12822 SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via… CVSS 3.0CRITICAL 9.8
- TI-2019-10994 wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters… CVSS 3.1HIGH 8.8
- TI-2026-02607 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter CVSS 3.1HIGH 7.5
Sources
- CVE-2026-2021 · CVE Program
- CVE-2026-2021 · NVD
- FIRST EPSS
- GHSA-5qqr-q6rw-943w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences