CVE-2026-83532CWE-79cross-site-scripting

CVE-2026-83532

Medium · published September 12, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-12T10:16Z
References (1)
https://wpscan.com/vulnerability/164f3fdd-00a6-482f-b3a2-78b50508011d/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 12 SEP 06:00Z
    Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
    cvelistv5