CVE-2026-83532
Received Received - Intake

Custom Menu Wizard Widget WordPress Plugin XSS Vulnerability

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-83532
EUVD
EUVD-2026-76817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
custom_menu_wizard custom_menu_wizard to 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the Custom Menu Wizard WordPress plugin versions 3.3.1 and earlier. It allows users with contributor-level access or higher to inject malicious scripts through shortcode attributes. These scripts execute when the affected content is viewed because the plugin does not properly sanitize or escape the attributes before rendering them into HTML.

Detection Guidance

Check for the Custom Menu Wizard WordPress plugin version 3.3.1 or earlier. Inspect shortcode attributes in posts or pages for unsanitized input that may contain malicious scripts. Use WPScan to scan for vulnerable versions: wpscan --url <your-site-url> --enumerate vp,vt

Review user roles with contributor-level access or higher for unusual activity. Monitor HTML output for unexpected script tags or event handlers in rendered content.

Impact Analysis

An attacker with contributor-level access could inject malicious scripts into your WordPress site. When visitors view the compromised content, these scripts could steal cookies, session tokens, or sensitive data, redirect users to malicious sites, or perform actions on behalf of the user without their consent.

Compliance Impact

This vulnerability could lead to data breaches, exposing user data such as personal information or credentials. For GDPR, it may result in non-compliance due to unauthorized data access or processing. For HIPAA, it could compromise protected health information, violating security requirements and leading to legal penalties.

Mitigation Strategies

Update the Custom Menu Wizard plugin to the latest version if available. If no update exists, consider disabling or removing the plugin immediately.

Restrict contributor-level and higher user roles to trusted individuals only. Implement a web application firewall to block XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart