EUVD-2026-14005
GHSA-qgp7-6qw9-gvc2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Post Flagger WordPress plugin for all versions up to and including 1.1, caused by insufficient input sanitization and output escaping in the 'flag' shortcode's user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript code into pages, which executes for all users who view those pages. This vulnerability has a CVSS score of 6.4 (Medium) and is confirmed in the WordPress plugin repository; no evidence of active exploitation or public proof-of-concept is currently documented, but the straightforward nature of the vulnerability suggests exploitation potential.
Technical ContextAI
The Post Flagger plugin (CPE: cpe:2.3:a:nosoycesaros:post_flagger:*:*:*:*:*:*:*:*) is a WordPress extension that provides a shortcode mechanism for flagging content. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting). The root cause lies in the plugin's 'flag' shortcode handler, specifically around line 66 of post-flagger.php (as referenced in the WordPress plugin repository), where shortcode attributes are processed without proper sanitization via WordPress escaping functions such as wp_kses_post() or esc_attr(). When shortcode attributes are rendered into page output, unsanitized user input passes directly into the HTML context, allowing attackers to inject script tags or event handlers that bypass WordPress's default security filters.
RemediationAI
Update the Post Flagger plugin to a patched version immediately; check https://wordpress.org/plugins/post-flagger/ and https://plugins.trac.wordpress.org/browser/post-flagger/ for the latest available version (expected to be version 1.2 or higher). If an update is not yet available, consider deactivating and removing the plugin until a patch is released. For WordPress administrators unable to patch immediately, enforce contributor-level content review by restricting the 'flag' shortcode to administrator-only usage via code filters, or implement a Web Application Firewall (WAF) rule to block script tags in post content. Additionally, audit existing posts created by contributor-level users for malicious shortcode attributes and remove any suspicious entries.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today