Vulnerabilities / Category Slider for WooCommerce / WPSEC-2026-1898
Category Slider for WooCommerce <= 1.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom JS Setting
Medium 4.4
CWE-79Fixed in 1.7.3
- ID
- WPSEC-2026-1898
- Plugin
- Product Category Slider & Grid for WooCommerce – Reno Product Category (woo-category-slider-grid)
- Affected
- all versions before 1.7.3
- Remediation
- Update to 1.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Category Slider for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Product Category Slider & Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS and custom CSS settings in all versions up to, and including, 1.7.2 due to the plugin accepting these values from users who lack the unfiltered_html capability. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary JavaScript that will execute whenever a user accesses a page containing the slider. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1898/
- https://plugins.svn.wordpress.org/woo-category-slider-grid/tags/1.7.3/
- https://wordpress.org/plugins/woo-category-slider-grid/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS