WordPress Plugin Vulnerabilities

Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

Description

The plugin does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
child-pages-card
Fixed in 1.09

References

CVE
CVE-2026-18395

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
999656c5-2e2d-4af8-9941-36184545f487

Timeline

Publicly Published
2026-07-31 (about 6 days ago)
Added
2026-07-31 (about 5 days ago)
Last Updated
2026-07-31 (about 5 days ago)

Other

Published
Title
Published
2024-01-03
Title
Essential Addons for Elementor < 5.9.3 - Contributor+ Stored XSS
Published
2025-01-30
Title
Automatically Hierarchic Categories in Menu < 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2014-10-01
Title
Subscribe2 < 10.16 - XSS
Published
2024-09-24
Title
ElementsKit Elementor addons < 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
Published
2012-05-15
Title
Sharebar <= 1.2.1 - SQL Injection & Cross-Site Scripting (XSS)