CVE-2026-14844

Master Slider WordPress plugin through 3.11.2 is vulnerable to Stored XSS caused by unsanitised and unescaped ms_slider shortcode attributes output into an inline script context . Users with the Contributor role or higher can inject malicious code that executes when the affected post is viewed. T...

CVE-2026-14844 Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...