CVE-2026-83532
Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
| Vendor | unknown |
| Product | custom menu wizard widget |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown custom menu wizard widget
Be the first to know when new medium vulnerabilities affecting unknown custom menu wizard widget are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Custom Menu Wizard Widget
0 ≤ 3.3.1
References
Credits
Artus KG WPScan