CVE-2026-83532: Custom Menu Wizard Widget XSS Vulnerability

CVE-2026-83532 Overview

CVE-2026-83532 is a stored Cross-Site Scripting (XSS) vulnerability in the Custom Menu Wizard Widget WordPress plugin through version 3.3.1. The plugin fails to sanitize and escape several shortcode attributes before rendering them into HTML output. Authenticated users with contributor-level access or higher can inject arbitrary web scripts that execute when other users view the affected content. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, privilege escalation, and site defacement.

Affected Products

Custom Menu Wizard Widget WordPress plugin, all versions through 3.3.1
WordPress installations that permit contributor-level user registration
Sites using the plugin's shortcode functionality in published content

Discovery Timeline

2026-09-12 - CVE-2026-83532 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-83532

Vulnerability Analysis

The Custom Menu Wizard Widget plugin exposes a shortcode that accepts multiple user-controlled attributes. The plugin renders these attributes directly into the HTML response without applying sanitization or context-aware escaping. When a contributor embeds the shortcode with a malicious attribute value in a post, the payload is stored in the WordPress database. WordPress then executes the shortcode server-side each time the containing page is rendered, injecting the attacker-controlled string into the DOM of every visitor.

The attack requires an authenticated account with the contributor capability or higher. Contributor is a low-trust role in WordPress that can create draft content but cannot publish it. However, once an administrator or editor reviews and publishes the draft, the stored payload executes in their session. Full technical details are available in the WPScan Vulnerability Report.

Root Cause

The root cause is missing output escaping in the shortcode handler. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() for safe HTML rendering, but the plugin passes attribute values directly into the generated markup. This violates the WordPress secure coding guideline requiring escape-on-output for any dynamic value.

Attack Vector

Exploitation requires network access to the WordPress site and a valid contributor account. The attacker authors a draft post containing the plugin's shortcode with a script payload embedded in one of the vulnerable attributes. When a higher-privileged user previews or publishes the post, the payload runs in their authenticated browser session. The attacker can then hijack the session, create administrative accounts, or install a backdoor plugin.

No verified public proof-of-concept code is available. Refer to the WPScan advisory for the vulnerable attribute names.

Detection Methods for CVE-2026-83532

Indicators of Compromise

Draft or published posts containing the Custom Menu Wizard shortcode with <script>, onerror=, onload=, or javascript: substrings in attribute values
New WordPress administrator accounts created immediately after a contributor draft is published
Unexpected outbound requests from the WordPress server or admin browsers to attacker-controlled domains
Modifications to core WordPress files or the wp_options table active_plugins entry following post publication

Detection Strategies

Query the wp_posts table for post_content values matching the plugin shortcode combined with HTML event handlers or script tags
Monitor plugin file integrity for Custom Menu Wizard Widget installations at version 3.3.1 or earlier
Deploy a web application firewall rule that inspects submitted post content for XSS payloads targeting shortcode attributes
Review WordPress audit logs for contributor accounts that repeatedly create drafts containing shortcodes

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on public pages
Alert on any privilege changes to WordPress user accounts, particularly promotions to administrator
Log and review all POST requests to /wp-admin/post.php and /wp-admin/post-new.php from contributor-role sessions
Track plugin version inventory across managed WordPress sites and flag installations at or below version 3.3.1

How to Mitigate CVE-2026-83532

Immediate Actions Required

Audit the WordPress plugin inventory to identify any site running Custom Menu Wizard Widget version 3.3.1 or earlier
Deactivate and remove the plugin on affected sites until a patched release is available and verified
Review all draft and published posts containing the plugin's shortcode for suspicious attribute values
Rotate credentials for all administrator and editor accounts that may have viewed content authored by untrusted contributors

Patch Information

As of the last NVD update on 2026-09-14, no fixed version has been published in the enriched CVE data. Monitor the WPScan advisory and the plugin's WordPress.org page for a patched release beyond version 3.3.1. Apply the update immediately once available.

Workarounds

Restrict contributor-role registration and require administrator approval for any new low-privilege accounts
Remove the plugin's shortcode from any published content and disable the plugin globally until patched
Deploy a WAF rule that blocks HTML event handlers and <script> tags within POST bodies targeting /wp-admin/ endpoints
Implement a strict Content Security Policy that disallows inline scripts on the WordPress front end

bash

# Identify installed plugin version and disable via WP-CLI
wp plugin list --name=custom-menu-wizard --fields=name,status,version
wp plugin deactivate custom-menu-wizard
wp plugin delete custom-menu-wizard