CVE-2026-105316: Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The affected AJAX actions are available to unauthenticated users, so an attacker does not need a WordPress account. Exploitation still requires user interaction, such as causing a victim to submit or follow a crafted request.
Which plugin versions are affected?
Magee Shortcodes through version 2.1.1 is affected. The provided information does not identify a fixed version.
What functionality is involved?
The issue affects the live_preview and magee_create_shortcode AJAX actions. Unsanitized and unescaped user input can be reflected in their responses and execute as script in a victim's browser.