What is GHSA-9jf6-vw36-77hj?

GHSA-9jf6-vw36-77hj is a security advisory published by GitHub Security Advisories with Medium severity. The Post Grid, Slider \u0026 Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and...

Which CVE IDs does GHSA-9jf6-vw36-77hj cover?

GHSA-9jf6-vw36-77hj covers the following CVE IDs: CVE-2026-16260. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9jf6-vw36-77hj?

GHSA-9jf6-vw36-77hj has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-9jf6-vw36-77hjMediumCVSS 6.8

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and...

Vendor

GitHub Security Advisories

Published

August 22, 2026

Last Modified

August 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-16260 →

📋 Description

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16260
https://wpscan.com/vulnerability/87c95831-d1b4-42b2-8fc7-6cba60fca400
https://github.com/advisories/GHSA-9jf6-vw36-77hj