EUVD-2026-53732
GHSA-9q2r-jhpg-jc6h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor authentication required (PR:L), victim must view malicious page (UI:R), XSS crosses browser context boundary (S:C); no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the plugin processes WordPress shortcode attributes supplied by contributors and reflects them into page HTML without sanitizing or escaping special characters. WordPress shortcodes parse user-controlled key-value pairs and embed rendered output directly into post/page content; failure to apply wp_kses, esc_attr, or equivalent sanitization before output allows injection of arbitrary HTML and JavaScript. The affected product identified via CPE is cpe:2.3:a:unknown:child_pages_card:*:*:*:*:*:*:*:*, covering all versions before 1.09. Because the payload is stored in the database rather than reflected in a URL, it executes for every subsequent visitor to the affected page, including administrators.
RemediationAI
Update the Child Pages Card WordPress plugin to version 1.09 or later, which introduces proper sanitization and escaping of shortcode attributes and is the only confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/999656c5-2e2d-4af8-9941-36184545f487/). If an immediate update is not feasible, restrict the contributor role exclusively to trusted users and audit existing site users for unnecessary privilege assignments - this eliminates the attack surface since exploitation requires at least contributor access. As a more disruptive temporary measure, deactivate the Child Pages Card plugin entirely; note this will remove all child-page card shortcode rendering from affected pages until the plugin is updated and reactivated. Open user registration should be disabled if not required, as it is the most common vector for obtaining contributor accounts on public sites.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today