Stored Cross-Site Scripting Vulnerability in Columns by BestWebSoft Plugin for WordPress

CVE-2026-3618

What is CVE-2026-3618?

The Columns by BestWebSoft plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack through the 'id' shortcode attribute in the [print_clmns] shortcode. This vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated users with Contributor-level access and higher to inject malicious scripts into the output. The plugin directly processes the 'id' parameter, embedding it into HTML and inline CSS without proper sanitization, which can lead to execution of harmful scripts by users browsing the affected pages. The exploitable code resides in multiple lines of the shortcode's implementation, and the attack necessitates that at least one column be created by an admin.

References