EUVD-2026-14001
GHSA-p2qc-8gvm-5vgq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The iVysilani Shortcode WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'width' shortcode attribute due to insufficient input sanitization and output escaping. All versions up to and including 3.0 are affected, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that persists in page content and executes for all subsequent site visitors. The vulnerability has been documented by Wordfence with proof-of-concept code available in the WordPress plugin repository, presenting a significant risk to WordPress installations relying on this plugin.
Technical ContextAI
The iVysilani Shortcode plugin (CPE: cpe:2.3:a:deckercz:ivysilani_shortcode:*:*:*:*:*:*:*:*) is a WordPress plugin that provides shortcode functionality for embedding content. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The root cause stems from inadequate input validation and output encoding of the 'width' shortcode parameter when it is rendered into page HTML. WordPress shortcodes are processed server-side and their output is embedded directly into page content; when user-supplied input within shortcode attributes is not properly escaped using functions like esc_attr() or esc_html(), attackers can inject malicious script tags or event handlers that will be executed in the context of the webpage, affecting all users who view the compromised page.
RemediationAI
The primary remediation is to upgrade the iVysilani Shortcode plugin to a patched version released after 3.0, which should include proper input sanitization and output escaping of the 'width' shortcode attribute using WordPress escaping functions. Administrators should immediately check for available updates in their WordPress plugin dashboard and apply them. If a patched version is not yet available from the vendor, the plugin should be deactivated and removed until a security update is released, as the stored nature of this XSS vulnerability means malicious payloads could persist in page content indefinitely. Site administrators should also audit recent page and post content created by Contributor-level users to identify and remove any suspicious shortcode attributes, and consider reviewing user access logs for the timeframe in which the plugin was vulnerable. Refer to the Wordfence threat intelligence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/25fc2600-9b57-405e-9956-b55291161700?source=cve for the latest patch status and guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today