Description
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
Published: 2026-10-07
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross-site Scripting (Reflected)
Action: Immediate Patch
AI Analysis

Impact

The Magee Shortcodes WordPress plugin, versions up to 2.1.1, fails to sanitize and escape user input received via the AJAX actions "live_preview" and "magee_create_shortcode". These actions are accessible to unauthenticated users, and the plugin reflects unfiltered data back in the response. An attacker can inject malicious JavaScript that executes in the browsers of anyone who triggers the vulnerability. This flaw is a classic reflected cross‑site scripting vulnerability (CWE-79), potentially allowing session hijacking or phishing content to be delivered to end users.

Affected Systems

Any WordPress installation that has the Magee Shortcodes plugin installed in version 2.1.1 or older.

Risk and Exploitability

The vulnerability can be exploited remotely by sending a crafted request to the vulnerable AJAX endpoints. Because authentication is not required, an attacker can trigger the flaw from any network location. The CVSS score of 7.1 reflects the high impact of client‑side code execution. EPSS is not available, and the vulnerability is currently not listed in the CISA KEV catalog, but the nature of XSS indicates a measurable risk, especially against sites with high traffic or sensitive user interactions.

Generated by OpenCVE AI on October 7, 2026 at 11:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Magee Shortcodes plugin to a version newer than 2.1.1 where the issue is fixed.
  • If an upgrade is not immediately possible, block or disable the "live_preview" and "magee_create_shortcode" AJAX endpoints for unauthenticated users using a security plugin or server configuration.
  • As a temporary control, implement a web‑application firewall rule to strip or encode suspicious payloads targeting those endpoints.

Generated by OpenCVE AI on October 7, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions magee Shortcodes
Vendors & Products Wordpress-extensions
Wordpress-extensions magee Shortcodes

Wed, 07 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
Title Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
References

Subscriptions

Wordpress-extensions Magee Shortcodes
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-07T09:57:07.854Z

Reserved: 2026-10-05T07:35:09.220Z

Link: CVE-2026-105316

cve-icon Vulnrichment

Updated: 2026-10-07T09:53:57.640Z

cve-icon NVD

Status : Deferred

Published: 2026-10-07T07:16:59.403

Modified: 2026-10-07T14:52:43.420

Link: CVE-2026-105316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:29:54Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')