EUVD-2026-14190
GHSA-4274-9vhj-c283
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'width', 'height', 'src', 'title', 'description', 'game_url', 'main', and 'thumb', which are all directly concatenated into HTML output without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The WP Games Embed WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 0.1beta due to insufficient input sanitization and output escaping of shortcode attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript through shortcode parameters such as 'width', 'height', 'src', 'title', 'description', 'game_url', 'main', and 'thumb', which are directly concatenated into HTML output without escaping. When other users visit pages containing the malicious shortcode, the injected scripts execute in their browsers, potentially allowing session hijacking, credential theft, or malware distribution.
Technical ContextAI
The vulnerability stems from a failure to implement proper output encoding in a WordPress plugin handling user-supplied shortcode attributes. WordPress shortcodes are a templating mechanism that allows users to embed dynamic content, and the [game] shortcode handler in WP Games Embed (identified via CPE cpe:2.3:a:sammyb:wp_games_embed:*:*:*:*:*:*:*:*) directly embeds unescaped attribute values into HTML context. The root cause falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS vulnerability class. The plugin fails to use WordPress escaping functions such as esc_attr() for HTML attributes or esc_url() for URL attributes, allowing HTML and JavaScript syntax to pass through unfiltered. Multiple code locations in wp-games-embed.php (lines 14, 32, 35, and 41 per references) concatenate these attributes directly into output, compounding the exposure across multiple injection vectors.
RemediationAI
The primary remediation is to upgrade the WP Games Embed plugin to a patched version or disable the plugin if no patch is available. Site administrators should immediately update via the WordPress plugin dashboard or install a fixed release from the plugin repository if the vendor has issued one. As a temporary workaround pending plugin updates, restrict Contributor-level role assignments to trusted authors only, and audit existing contributors to remove unnecessary permissions. Additionally, implement a Web Application Firewall (WAF) rule to detect and block shortcode attributes containing script tags or event handlers, and consider using a security plugin such as Wordfence or Sucuri to scan for stored malicious content already injected into post or page content. Administrators without a patch should disable or remove the WP Games Embed plugin entirely until a security update is released and thoroughly tested in a staging environment before production deployment.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today