Vulnerability · Published Aug 22, 2026 · Assigned by WPScan

CVE-2026-16260Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

Medium 6.8

In plain English

A medium-severity cross-site scripting in Post Grid, Slider & Carousel Ultimate from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 62.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Post Grid, Slider & Carousel Ultimate	0 – before 1.8.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/87c95831-d1b4-42b2-8fc7-6cba60fca400/ exploit, vdb-entry, technical-description