CVE-2026-83532

Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

Affected

Custom Menu Wizard Widget

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/164f3fdd-00a6-482f-b3a2-78b50508011d/

References

• CVE Record
• NVD entry