PT-2026-33253 · WordPress · Codecolorer

Chawabhon Netisingha · Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-4032

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeColorer versions prior to 0.10.2

Description The CodeColorer plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the class parameter of the 'cc' comment shortcode. Unauthenticated attackers can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. This exploitation is possible if comments are enabled on the target post and guest comments are permitted.

Recommendations Update to a version later than 0.10.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4032

Affected Products

Codecolorer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4032 · Security Note
• https://twitter.com/CVEnew/status/2044701582907060479 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/44fd7e13-f48a-43c6-a735-15036aa03005?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3481552/codecolorer · Note
• https://twitter.com/VulmonFeeds/status/2044797139046334892 · Twitter Post