PT-2026-26866 · WordPress · Wp Games Embed

CVE-2026-3996

·

Publicado

2026-03-21

·

Atualizado

2026-03-21

CVSS v3.1

6.4

Média

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions WP Games Embed plugin for WordPress versions up to and including 0.1beta
Description The WP Games Embed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the [game] shortcode. Insufficient input sanitization and output escaping of user-supplied shortcode attributes – width, height, src, title, description, game url, main, and thumb – allows for the injection of arbitrary web scripts. These attributes are directly concatenated into HTML output without proper escaping. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into pages, which will then execute when a user accesses those pages.
Recommendations Update the WP Games Embed plugin to a version beyond 0.1beta.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3996

Produtos afetados

Wp Games Embed