CVE-2026-14844

Master Slider WordPress plugin (through 3.11.2 ) fails to sanitise and escape certain shortcode attributes before outputting them in an inline script context, enabling Stored XSS for users with the Contributor role or above. The payload executes when the affected post is viewed. No fixed version ...