EUVD-2026-22863
GHSA-jxvc-xjm6-c4gc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [circliful] shortcode and via multiple shortcode attributes of the [circliful_direct] shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the circliful_shortcode() function, the 'id' attribute value is concatenated directly into an HTML id attribute (line 285) without any escaping, allowing an attacker to break out of the double-quoted attribute and inject arbitrary HTML event handlers. Similarly, the circliful_direct_shortcode() function (line 257) outputs all shortcode attributes directly into HTML data-* attributes without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in WP Circliful plugin for WordPress up to version 1.2 allows authenticated attackers with Contributor-level access to inject arbitrary HTML and JavaScript via insufficiently sanitized shortcode attributes in [circliful] and [circliful_direct] shortcodes. The vulnerability exists in the circliful_shortcode() and circliful_direct_shortcode() functions, which concatenate user input directly into HTML attributes without escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser. No public exploit code or active exploitation in the wild has been confirmed at time of analysis.
Technical ContextAI
The WP Circliful plugin (cpe:2.3:a:bappidgreat:wp_circliful:*:*:*:*:*:*:*:*) is a WordPress plugin that implements shortcode handlers to render circular progress indicators. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, a.k.a. Cross-site Scripting). Specifically, the circliful_shortcode() function at line 285 and the circliful_direct_shortcode() function at lines 257 and 263 fail to apply proper output escaping when constructing HTML attributes from user-supplied shortcode parameters. The 'id' attribute in [circliful] and all data-* attributes in [circliful_direct] are populated with unescaped values, allowing attackers to break out of quoted attribute context and inject event handlers or arbitrary HTML elements. WordPress provides escaping functions like esc_attr() and esc_html() that should have been applied but were omitted.
RemediationAI
Update the WP Circliful plugin to a version newer than 1.2 if the vendor has released a patch. Website administrators should immediately deactivate and remove the plugin if no update is available. If continued use is necessary pending a patch, restrict Contributor-level access or higher to trusted users only, and audit existing posts and pages for malicious shortcodes. The underlying fix requires applying WordPress escaping functions (esc_attr() for HTML attributes, esc_html() for text content) to all user-supplied shortcode parameters before output. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/030534e2-bf7d-42e4-94a1-986f629bea15?source=cve for additional guidance and confirmation of patched versions when available.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today