CVE-2026-105316
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: WPScan

Description
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-105316
EUVD
EUVD-2026-94185

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Magee Shortcodes 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Magee Shortcodes WordPress plugin through version 2.1.1 has a reflected Cross-Site Scripting (XSS) vulnerability. This occurs because user input in certain AJAX actions is not properly sanitized or escaped before being reflected back in responses. These actions are accessible to unauthenticated users, allowing attackers to inject malicious scripts.

Detection Guidance

Check if the Magee Shortcodes WordPress plugin version 2.1.1 or below is installed. Look for AJAX actions 'live_preview' and 'magee_create_shortcode' in network traffic or server logs. Test by sending crafted input to these endpoints and observing if scripts execute in responses.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary JavaScript in a victim's browser when they visit a specially crafted webpage. This could lead to session hijacking, defacement, or theft of sensitive information like cookies or login credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised through this exploit.

Mitigation Strategies

Immediately update the Magee Shortcodes plugin to the latest version if an update is available. If no update exists, consider disabling the plugin until a patch is released. Implement input validation and output escaping for AJAX actions on your WordPress site.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart