CVE-2026-8900 is a stored cross-site scripting vulnerability in the Simple SEO Slideshow plugin for WordPress, affecting all versions up to and including 1.2.8. The vulnerability arises from insufficient input sanitization and output escaping of shortcode attributes, allowing authenticated users with contributor-level privileges or above to inject arbitrary scripts. These scripts execute in the context of any user viewing the page containing the injected shortcode, due to WordPress KSES not filtering malicious shortcode attribute values on post save. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level access can persist malicious JavaScript in shortcode attributes that execute in the browsers of users viewing the affected pages, including administrators. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and requires authenticated access, but the scope is changed as the injected script runs in the context of other users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Monitor plugin updates from the vendor for an official fix addressing input sanitization and output escaping of shortcode attributes.