EUVD-2026-24702

🗓️ 22 Apr 2026 09:31:33Reported by EUVDType

Stored XSS in the WordPress Posts map plugin via the 'name' shortcode attribute affects versions up to 0.1.3; authenticated contributors can inject scripts executed when users view the page.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-6236	22 Apr 202607:45	–	attackerkb
Circl	CVE-2026-6236	25 Apr 202614:33	–	circl
CNNVD	WordPress plugin Posts map 跨站脚本漏洞	22 Apr 202600:00	–	cnnvd
CVE	CVE-2026-6236	22 Apr 202607:45	–	cve
Cvelist	CVE-2026-6236 Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute	22 Apr 202607:45	–	cvelist
NVD	CVE-2026-6236	22 Apr 202609:16	–	nvd
Positive Technologies	PT-2026-34307	22 Apr 202600:00	–	ptsecurity
Positive Technologies	PT-2026-36320	1 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-6236 Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute	22 Apr 202607:45	–	vulnrichment

[
  {
    "enisaIdVendor": [
      {
        "id": "da8f82e3-8a31-3b82-a3ee-7877a2c73d15",
        "vendor": {
          "name": "lucdecri"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "8c634634-04f3-30be-af5f-62f00493bc0b",
        "product": {
          "name": "Posts map"
        },
        "product_version": "0 ≤0.1.3"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e02c5817-7a54-4958-a076-71e5e7729cda
wordpress	www.wordpress.org/plugins/posts-map/
plugins	www.plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php
plugins	www.plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-6236

22 Apr 2026 09:31Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00013

SSVC