CVE-2026-4076 is a stored cross-site scripting vulnerability in the Slider Bootstrap Carousel WordPress plugin by felipermendes. The plugin improperly neutralizes input by failing to escape the 'category' and 'template' shortcode attributes before outputting them into HTML attributes such as id, data-target, href, and class. This flaw allows authenticated users with Contributor-level privileges or above to inject malicious scripts that execute in the context of any user viewing the affected pages. The vulnerability is present in all versions up to and including 1.0.7. No official patch or remediation has been documented yet.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode attributes. This can lead to the execution of arbitrary JavaScript in the browsers of users who visit the compromised pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and avoid using the vulnerable shortcode attributes in published content. Monitor for updates from the plugin author or WordPress security advisories for an official patch or mitigation instructions.