{
 "id": "WPSEC-2026-1898",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1898/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1898/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1898/index.md",
 "title": "Category Slider for WooCommerce <= 1.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom JS Setting",
 "description": "The Product Category Slider & Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS and custom CSS settings in all versions up to, and including, 1.7.2 due to the plugin accepting these values from users who lack the unfiltered_html capability. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary JavaScript that will execute whenever a user accesses a page containing the slider. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
 "plugin": {
  "slug": "woo-category-slider-grid",
  "name": "Category Slider for WooCommerce",
  "full_name": "Product Category Slider & Grid for WooCommerce – Reno Product Category",
  "wordpress_org": "https://wordpress.org/plugins/woo-category-slider-grid/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-category-slider-grid/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-category-slider-grid"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.3",
 "remediation": "Update to 1.7.3 or later.",
 "fix_released": "2026-10-28T05:54:49+00:00",
 "published": "2026-10-29T06:44:57+00:00",
 "updated": "2026-10-28T09:20:12.420904+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1898/",
  "https://plugins.svn.wordpress.org/woo-category-slider-grid/tags/1.7.3/",
  "https://wordpress.org/plugins/woo-category-slider-grid/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-category-slider-grid",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}