VULNERABILITY INTELLIGENCE

CVE-2026-18395

CVSS score5.4 MEDIUM

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-08-06

Last modified2026-08-26

Description

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.