Stored Cross-Site Scripting in List Category Posts Plugin for WordPress

CVE-2026-3005

What is CVE-2026-3005?

The List Category Posts plugin for WordPress is susceptible to Stored Cross-Site Scripting due to improper input sanitization and escaping of user-supplied data via the 'catlist' shortcode. Authenticated attackers with contributor-level access can exploit this flaw to inject arbitrary JavaScript into pages. When users visit an affected page, malicious scripts execute in their browsers, potentially leading to data theft or site compromise. It is crucial for users and administrators to apply security best practices to mitigate this risk.

References