CVE-2026-14844 is a stored Cross-Site Scripting vulnerability in the Master Slider WordPress plugin versions up to and including 3.11.2. The vulnerability arises from insufficient sanitization and escaping of certain shortcode attributes before they are output within inline scripts. This flaw allows users with Contributor role or above to inject malicious scripts that execute upon viewing the affected post. There is no fixed version available at this time. Recommended mitigations include restricting Contributor role usage, deactivating the plugin, or blocking the ms_slider shortcode for roles below Editor to prevent exploitation.

Exploitation of this vulnerability allows users with Contributor role or higher to perform stored XSS attacks, potentially leading to script execution in the context of site visitors viewing the affected post. This could result in session hijacking, defacement, or other malicious actions depending on the attacker's payload. The vulnerability affects site integrity and user security but requires authenticated user privileges at least at the Contributor level.

No official patch or fixed version is currently available. Until a fix is released, site owners should restrict the Contributor role to trusted users only or deactivate the Master Slider plugin if possible. Alternatively, blocking the ms_slider shortcode for roles below Editor can prevent exploitation without disabling the plugin entirely.