High severity · published Oct 7, 2026
CVE-2026-105316
Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Magee Shortcodes ·
through 2.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105316
exploit
https://wpscan.com/vulnerability/8240033a-bb4b-490f-97da-4ae768d2cb6d/
More from Magee Shortcodes
5.4
CVE-2023-4783
Magee Shortcodes <= 2.1.1 - Contributor+ Stored XSS via shortcode
5.3
CVE-2026-105322
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form