All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-16758
MEDIUMpublished 2026-08-16 06:16 UTC · 2 days ago · modified 2026-08-17 16:16 UTC
6.4
CVSS / 10
// description
The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
// weaknesses (CWE)
- CWE-79
// references (5)
- https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/functions.php#L81
- https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/shortcode.user.php#L14
- https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/shortcode.user.php#L74
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3647346%40shortcode-variables&new=3647346%40shortcode-variables