UNKNOWN NVD

CVE-2026-83532

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

References

https://wpscan.com/vulnerability/164f3fdd-00a6-482f-b3a2-78b50508011d/

Published: 2026-09-12 · Source: NVD · Feed updated: 2026-09-12

This unknown severity vulnerability was published on 2026-09-12 via NVD.

vulnfeed aggregates 12854 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.