CVE-2026-14844: Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.
No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the msslider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Master Slider WordPress plugin (through 3.11.2)from your environment.Deactivate the Master Slider WordPress plugin through 3.11.2 until a fix is available.
- Compensating control
Restrict the WordPress shortcode ms_slider so it cannot be used by roles below Editor (e.g., via the “shortcode-restriction” Master Slider WordPress plugin) to prevent Contributor+ stored XSS.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can exploit it. The attacker must be able to create or modify content containing the ms_slider shortcode and its affected attributes.
When does the malicious script execute?
The XSS payload is stored in a post and executes when a user views the affected post. The vulnerable shortcode attributes are output in an inline script context.
Is there a fixed release available?
No fixed version is available. The issue affects Master Slider through version 3.11.2.
What can be done if the plugin cannot be deactivated?
Restrict the Contributor role to trusted users, or prevent roles below Editor from using the ms_slider shortcode. A shortcode restriction mechanism can block the shortcode for those roles while leaving the plugin active.