Stored Cross-Site Scripting in WP Circliful Plugin for WordPress

CVE-2026-3659

What is CVE-2026-3659?

The WP Circliful plugin is prone to Stored Cross-Site Scripting vulnerabilities due to inadequate input sanitization and output escaping of user-supplied shortcode attributes. Attackers with Contributor-level access can exploit this flaw through both the 'id' attribute in the [circliful] shortcode and various attributes in the [circliful_direct] shortcode. The affected functions directly output these attributes into HTML elements without proper escaping, allowing arbitrary HTML event handlers or scripts to be injected. This poses significant risks to users as malicious scripts can execute upon page visits.

References