EUVD-2026-14146
GHSA-2rgw-rqcx-h77r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Show Posts list - Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute in the 'swiftpost-list' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Show Posts List plugin for WordPress (versions up to 1.1.0) affecting the 'swiftpost-list' shortcode's 'post_type' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code into pages, which executes whenever any user views the compromised page. With a CVSS score of 6.4 and network-accessible attack vector requiring only low privileges, this represents a moderate-priority vulnerability for WordPress installations using this plugin, particularly those with multi-user environments.
Technical ContextAI
This vulnerability stems from improper handling of user-supplied shortcode attributes in the WordPress plugin ecosystem. The 'swiftpost-list' shortcode in the Show Posts List plugin (identified via CPE as cpe:2.3:a:creativedev4:show_posts_list_–_easy_designs,_filters_and_more) fails to implement adequate input sanitization via WordPress sanitization functions (such as sanitize_text_field() or sanitize_key()) and lacks proper output escaping using functions like esc_attr() or wp_kses_post(). The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a well-established web application flaw category. The vulnerable code paths are visible in post-shortcode.php at multiple lines (21, 43, 103, 119), where the 'post_type' attribute and potentially other shortcode parameters are directly echoed or processed without escaping, allowing an attacker to break out of attribute contexts and inject malicious script tags.
RemediationAI
Update the Show Posts List plugin to a version newer than 1.1.0 immediately; check the official WordPress plugin repository or the vendor's website for patched versions (patches addressing CWE-79 input sanitization and output escaping issues should be available). If a patched version is not yet available from the vendor, disable or remove the plugin until a fix is released, as the vulnerability affects core shortcode functionality. As an interim control, restrict contributor-level account creation and limit contributor permissions to users who absolutely require them, audit existing contributors for suspicious account activity, and monitor page revisions for unexpected shortcode modifications. Additionally, implement WordPress security hardening by using Web Application Firewall (WAF) rules to detect and block shortcode attribute payloads containing script tags, and enable WordPress security plugins that provide XSS detection. For detailed vulnerability information and advisory tracking, refer to the Wordfence report linked above.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today