MEDIUM
CVE-2026-83532
CVSS
6.8
Description
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.24%
Probability of exploitation in next 30 days
14.8th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.