CVE-2026-105316

HighCVSS 7.1

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitize and escape user input in some AJAX actions available to unauthenticated users, leading to Reflected XSS.

Risk Assessment

An unauthenticated attacker can inject a malicious script that executes in the victim's browser, potentially leading to data theft or session hijacking.

Recommendation

Update the Magee Shortcodes plugin to a version later than 2.1.1.

Other vulnerabilities in Magee Shortcodes

CVE-2026-105322Medium
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

Original NVD description (English source)

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS