Detections
Analytics
CVE-2026-83532
medium
Description
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
References
https://wpscan.com/vulnerability/164f3fdd-00a6-482f-b3a2-78b50508011d/