CVE-2026-18395

The CVE-2026-18395 affects the WordPress plugin Child Pages Card prior to 1.09. The issue is improper sanitisation/escaping of shortcode attributes, enabling Stored XSS via attributes when exploited by users with the Contributor role or higher. Exploitation details are not provided in the documen...

EUVD-2026-53732

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...