The CC Child Pages WordPress plugin is vulnerable to stored cross‑site scripting. The 'child_pages' shortcode accepts four user‑supplied attributes—use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt—that are not properly sanitized or escaped, resulting in a CWE‑79 vulnerability. An attacker can inject arbitrary JavaScript into a page that will execute whenever a user visits that page.

This flaw targets Caterham Computing’s CC Child Pages plugin for WordPress. All versions up to and including 2.0.0 are affected; the vulnerability is present in every release up to that point.

The CVSS score of 6.4 indicates a moderate risk level, while the EPSS score of less than 1% shows exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication with contributor level or higher access, the threat is confined to users who can edit content using the 'child_pages' shortcode.