CVE-2026-18395: Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
Published Aug 6, 2026
·Updated
The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
1 affected component
WordPress Child Pages Card<1.09
Event History
Aug 6, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-18395?
CVE-2026-18395 has a risk rating of 40, indicating a significant vulnerability.
2
How do I fix CVE-2026-18395?
To fix CVE-2026-18395, update the Child Pages Card plugin to version 1.09 or later.
3
Who is affected by CVE-2026-18395?
Users with the contributor role and above can exploit CVE-2026-18395 to execute Stored XSS attacks.
4
What type of vulnerability is CVE-2026-18395?
CVE-2026-18395 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
5
When was CVE-2026-18395 published?
CVE-2026-18395 was published on August 6, 2026.