CVE-2026-83532: Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

Q: Which users can exploit this issue?

Users with contributor-level access or higher can exploit the issue by supplying malicious values in affected shortcode attributes.

Q: When does the injected script execute?

The script executes when someone views content that renders the affected shortcode.

Q: Are sites running version 3.3.1 affected?

Yes. The issue affects the plugin through version 3.3.1.

Published Sep 12, 2026

Updated

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

Affected Software

1 affected component

WordPress Custom Menu Wizard Widget<=3.3.1

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with contributor-level access or higher can exploit the issue by supplying malicious values in affected shortcode attributes.

When does the injected script execute?

The script executes when someone views content that renders the affected shortcode.

Are sites running version 3.3.1 affected?

Yes. The issue affects the plugin through version 3.3.1.