CVE-2026-4022
Received Received - Intake

Stored XSS in Show Posts List WordPress Plugin

Publication date: 2026-03-21

Last updated on: 2026-03-21

Assigner: Wordfence

Description
The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute in the 'swiftpost-list' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-21
Last Modified
2026-03-21
Generated
2026-07-26
AI Q&A
2026-03-21
EPSS Evaluated
2026-07-25
NVD
CVE-2026-4022
EUVD
EUVD-2026-14146

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
show_posts list to 1.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the Show Posts list – Easy designs, filters and more plugin for WordPress, specifically in the 'swiftpost-list' shortcode's 'post_type' attribute. It is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping of user-supplied attributes.

This means that authenticated users with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute whenever any user accesses the affected page.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can allow attackers with contributor-level access to inject arbitrary scripts into web pages, which will run in the context of users visiting those pages.

  • It can lead to theft of user credentials or session tokens.
  • It can enable unauthorized actions on behalf of users.
  • It can compromise the integrity and trustworthiness of the affected website.
Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart