CVE-2026-8900 describes a stored XSS vulnerability in the Simple SEO Slideshow plugin for WordPress, affecting all versions up to and including 1.2.8. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). Authenticated users with contributor or higher privileges can inject arbitrary scripts via shortcode attributes, which persist and execute for any visitor, including administrators. The issue is due to inadequate input sanitization and output escaping, combined with WordPress KSES not filtering malicious shortcode attribute values on post save.

An attacker with contributor-level access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the context of any user viewing the page, potentially leading to session hijacking, privilege escalation, or other attacks impacting confidentiality and integrity. The vulnerability does not affect availability. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity with scope change.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restrict contributor-level access to trusted users only and consider removing or disabling the Simple SEO Slideshow plugin until a fix is released. Applying strict content security policies or input filtering at the application level may help mitigate risk but are not full replacements for a proper fix.