WordPress Plugin Vulnerabilities

Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions

Description

The plugin does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
magee-shortcodes
No known fix

References

CVE
CVE-2026-105316

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
8240033a-bb4b-490f-97da-4ae768d2cb6d

Timeline

Publicly Published
2026-10-05 (about 2 days ago)
Added
2026-10-05 (about 1 day ago)
Last Updated
2026-10-05 (about 1 day ago)

Other

Published
Title
Published
2024-10-09
Title
Download Manager < 3.3.00 - Contributor+ Stored XSS
Published
2025-04-01
Title
AI Search Bar <= 2.1 - Unauthenticated Stored Cross-Site Scripting
Published
2024-09-17
Title
Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
Published
2015-12-02
Title
Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2026-07-10
Title
White Label CMS < 2.7.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings