EUVD-2026-22847
GHSA-wwww-f4wq-25hx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.
Technical ContextAI
The VI: Include Post By plugin processes the 'include-post-by-cat' shortcode and accepts user-supplied attributes including 'class_container' without proper sanitization or escaping. The shortcode handler directly interpolates these attributes into HTML output, violating the principle of contextual output encoding. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where an authenticated user with contributor privileges can craft malicious shortcodes containing JavaScript payloads. These payloads are persisted in the WordPress database and executed in the DOM context of every page visitor, bypassing client-side protections and affecting site-wide security posture.
RemediationAI
Update the VI: Include Post By plugin to the latest version available on WordPress.org immediately; if a patched version beyond 0.4.200706 has been released, upgrade to it. If no newer version is available, disable and deactivate the plugin until a security update is released, then conduct a post-incident security audit of all pages and posts created or modified by contributors during the plugin's active period to identify and remove any injected scripts. Restrict contributor-level access to trusted users only and implement code review workflows for shortcode usage. Monitor the plugin's repository page at https://plugins.trac.wordpress.org/browser/vi-include-post-by/trunk/ for security patches and follow Wordfence security advisories for further guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today