CVE-2026-6913

Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute

Published May 12, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

In the Shortcodely WordPress plugin the widget_area shortcode attribute is stored without adequate sanitization or escaping, allowing an authenticated user with contributor‑level access to inject malicious scripts into content. Those scripts execute whenever a user views the affected page, potentially enabling defacement, credential theft or other persistence attacks.

Affected Systems

The vendor patilswapnilv’s Shortcodely plugin for WordPress is impacted, with all releases up to and including version 1.0.1 vulnerable to exploited input. Site owners running these plugin versions and the widget_area shortcode are at risk.

Risk and Exploitability

The CVSS score of 6.4 indicates medium severity, and the vulnerability is not listed in the KEV catalog. Because exploitation requires authenticated contributor‑level privileges, attackers must first gain access to the WordPress backend; after injection the stored script executes for all subsequent visitors. With no EPSS data available the exploitation probability is uncertain, yet the potential user impact is significant due to persistent cross‑site scripting on content pages.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

patilswapnilv

Shortcodely

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.1

No data.

Vendor Product Versions

Patilswapnilv

Shortcodely

Version	Status	Scheme	Platform
`[0,1.0.1]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Shortcodely plugin to a version newer than 1.0.1 if available, or remove the plugin entirely if not required.
Eliminate usage of the widget_area shortcode or strip user‑supplied attributes from its content using proper escaping or sanitization libraries.
Restrict contributor and higher roles from editing or deleting pages that contain the widget_area shortcode, or enforce role‑based content restrictions.
Audit all posts and pages for injected code and remove any malicious content that may remain.

Generated by OpenCVE AI on May 12, 2026 at 10:44 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.201% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L118
https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L73
https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L92
https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L118
https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L73
https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L92
https://www.wordfence.com/threat-intel/vulnerabilities/id/08ef43cc-42ea-43bd-a590-4f9b2c719491?source=cve

History

May 13, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Patilswapnilv Patilswapnilv shortcodely Wordpress Wordpress wordpress
Vendors & Products		Patilswapnilv Patilswapnilv shortcodely Wordpress Wordpress wordpress

May 12, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 12, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L118 https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L73 https://plugins.trac.wordpress.org/browser/shortcodely/tags/1.0.1/shortcodely.php#L92 https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L118 https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L73 https://plugins.trac.wordpress.org/browser/shortcodely/trunk/shortcodely.php#L92 https://www.wordfence.com/threat-intel/vulnerabilities/id/08ef43cc-42ea-43bd-a590-4f9b2c719491?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`