CVE-2026-6236

Vulnerability

Details

The Posts map plugin for WordPress, versions up to and including 0.1.3, contains a stored cross-site scripting (XSS) vulnerability in the name shortcode attribute. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing malicious input to be stored and later rendered unsafely.

Exploitation

An authenticated attacker with at least contributor-level access can exploit this by crafting a shortcode with a malicious name attribute. When the page containing the shortcode is viewed by any user, the injected script executes in their browser. No additional authentication or network position is required beyond the contributor role.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Because the script is stored, every visitor to the affected page is at risk.

Mitigation

As of April 15, 2026, the plugin has been closed on the WordPress plugin repository pending a full review [1]. No patched version is available. Users are advised to remove the plugin immediately and consider alternative solutions.