Is CVE-2026-83532 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-83532

Description

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.