Executive brief
Custom Menu Wizard is a WordPress plugin that allows site administrators to create and customize menu widgets. The plugin fails to sanitize shortcode attributes before displaying them as HTML, allowing contributors and higher-privilege users to inject malicious scripts into pages. When site editors or visitors view the affected content, the injected scripts execute in their browsers with full access to their session, potentially allowing account takeover or data theft.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Custom Menu Wizard Widget WordPress plugin affecting versions through 3.3.1. The vulnerability exists in shortcode attribute processing, specifically the title_tag, wrap_link, and wrap_link_text attributes of the [cmwizard] and [custom_menu_wizard] shortcodes, which are not properly sanitized or escaped before rendering into HTML. An attacker with contributor-level access or higher can inject arbitrary HTML and JavaScript payloads into these attributes when creating or editing posts. The injected payload persists in the database (stored XSS) and executes in the browser of any user viewing the affected content, including administrators and site visitors. The attack requires the plugin to be active and at least one navigation menu to exist; the plugin has known compatibility issues with PHP 8.0+. No patch has been publicly released as of the advisory date.
Affected products
- Custom Menu Wizard Custom Menu Wizard Widget through 3.3.1
Timeline
- 2026-09-09: disclosed
- 2026-09-12: advisory