CVE-2026-16537

MediumCVSS 5.4/10Last modified Aug 26, 2026

Description

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Slick Slider	< 0.5.3

References

https://wpscan.com/vulnerability/8de9a050-45b5-4e51-9cd9-06f85999393a/

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-165389.1The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting CVE-2026-165398.1The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when du CVE-2026-16546.1The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in CVE-2026-165407.5The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester'CVE-2026-165416.5The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints CVE-2026-165424.1The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-si CVE-2026-165437.1Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a CVE-2026-165446.5A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consum CVE-2026-165464.3The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does CVE-2026-165475.9The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested,CVE-2026-165486.5The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not CVE-2026-16554.3The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up t