CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.29% chance of exploitation in the next 30 days, 21th percentile

Published

2026-08-22

Updated

2026-08-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/87c95831-d1b4-42b2-8fc7-6cba60fca400/

References

• CVE Record
• NVD entry

Related

• CVE-2026-16259
• CVE-2026-16261
• CVE-2026-16258
• CVE-2026-16262
• CVE-2026-16257
• CVE-2026-16263