THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-83532 (MEDIUM 6.8) — The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is

[NVD] CVE-2026-83532 (MEDIUM 6.8) — The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is

mednvdPublished 2026-09-12

CVE-2026-83532 CVSS: 6.8 MEDIUM Published: 2026-09-12T06:16:26.353

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

Indicators of compromise

CVE-2026-83532cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-83532