Child Pages Card
Monthly
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.