CVE-2026-3659

Name of the Vulnerable Software and Affected Versions WP Circliful versions prior to 1.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. In the circliful shortcode() function, the id attribute is concatenated directly into an HTML id attribute, allowing attackers to inject arbitrary HTML event handlers. Additionally, the circliful direct shortcode() function outputs all shortcode attributes directly into HTML data-* attributes without escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version later than 1.2.