EUVD-2026-24704Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Simple Random Posts Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'container_right_width' attribute of the 'simple_random_posts' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Simple Random Posts Shortcode plugin for WordPress versions up to 0.3 contains stored cross-site scripting (XSS) via insufficient sanitization of the 'container_right_width' shortcode attribute, allowing authenticated contributors and above to inject arbitrary JavaScript that executes in browsers of all users accessing affected pages. No active exploitation has been confirmed, but the vulnerability requires only contributor-level access and carries network-based attack vector with low complexity.
Technical ContextAI
The vulnerability exists in the WordPress plugin's shortcode handler, which processes user-supplied attributes without adequate input sanitization or output escaping. Specifically, the 'container_right_width' attribute of the 'simple_random_posts' shortcode is echoed directly into the page HTML without proper sanitization functions (such as sanitize_text_field() or similar WordPress-native sanitization) or escaping functions (such as esc_attr() when used in HTML attributes). This is a classic stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) where malicious input is persisted in the WordPress database as part of post/page content via shortcode attributes and later rendered without sanitization when the page is accessed. The attack vector is network-based because the shortcode can be embedded in any published post or page, making it accessible to remote users without direct system access.
RemediationAI
Update the Simple Random Posts Shortcode plugin to a version later than 0.3 if available; consult the plugin repository or vendor website for the latest patched release. If no patched version is available, immediately disable the plugin and remove or replace it with an actively maintained alternative. For sites unable to update immediately, restrict contributor-level access to trusted users only by reviewing WordPress user roles and capabilities (Settings > Users), and audit all existing posts and pages for 'simple_random_posts' shortcodes to identify and remove any that contain suspicious attribute values. Implement WordPress security hardening: enable code review workflows before post publishing, use security plugins (e.g., Wordfence) to detect and block malicious scripts, and apply Web Application Firewall (WAF) rules to block common XSS payloads in shortcode attributes. Review database backups to check for already-injected shortcodes. These compensating controls are not perfect substitutes for patching and should be combined with an update or plugin replacement plan.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today