PT-2026-26866 · WordPress · Wp Games Embed

CVE-2026-3996 · Published 2026-03-21 · Updated 2026-03-21

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Games Embed plugin for WordPress versions up to and including 0.1beta

Description The WP Games Embed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the [game] shortcode. Insufficient input sanitization and output escaping of user-supplied shortcode attributes – width, height, src, title, description, game url, main, and thumb – allows for the injection of arbitrary web scripts. These attributes are directly concatenated into HTML output without proper escaping. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into pages, which will then execute when a user accesses those pages.

Recommendations Update the WP Games Embed plugin to a version beyond 0.1beta.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3996

Affected Products

Wp Games Embed

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-3996 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6a8cc968-01a5-45b8-bee8-86c858f86514?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2035271591936889031 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L35 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L32 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L32 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L35 · Note
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L41 · Note
• https://twitter.com/CVEnew/status/2035237275798577205 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L14 · Note