CVE-2026-15726

Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 7,608 live websites that are affected by CVE-2026-15726.

Run a Free Instant Scan



Affected Software

Product  Cryout Serious Slider
Category Wordpress Plugins
Vulnerable Domains7,608 live websites (100% of Cryout Serious Slider install base)
Vulnerable Versions
  • from 0 through 1.4
Vulnerable Versions Count20 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 16, 2026
  • Updated - Aug 17, 2026

Credits

  • Wordfence PRISM (finder)

Website Distribution by Country

Number of websites using CVE-2026-15726
United States1,542 websites


Germany1,129 websites
Italy668 websites
Poland474 websites
France448 websites
Japan368 websites
Netherlands307 websites
GB275 websites
Brazil208 websites
Russia170 websites

Website Distribution by TLD

Number of websites using CVE-2026-15726
.com2,337 websites
.de757 websites
.org524 websites
.it444 websites
.pl392 websites
.nl274 websites
.net193 websites
.fr186 websites
.com.br143 websites
.ru141 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15726

Top websites that are affected by CVE-2026-15726. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.com United States**,***
*****.***************.eu Netherlands***,***
*****.jp Japan***,***
******.net Japan***,***
*********.com United States***,***
****************.com France***,***
*********.jp Japan***,***
******************.com United States***,***
*********.de Germany***,***
**********.com United States***,***
See full domain list

FAQ

CVE-2026-15726 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Cryout Serious Slider
A total of 7,608 websites have been identified as vulnerable to CVE-2026-15726, based on global website indexing conducted by WebTechSurvey.
The Cryout Serious Slider is affected by the CVE-2026-15726 vulnerability.
Cryout Serious Slider versions up to and including 1.4 are vulnerable to CVE-2026-15726.