CVE-2026-3005

BRIEFING NOTE - CVE-2026-3005 OVERVIEW The List Category Posts plugin for WordPress versions up to 0.94.0 contains a stored cross-site scripting (XSS) vulnerability in the 'catlist' shortcode. Insufficient input sanitization and output escaping of user-supplied attributes allows attackers to inject and persist malicious scripts within page content. SEVERITY This vulnerability requires network access and low privilege escalation (contributor-level or higher authentication), carrying a CVSS v3.1 base score of 6.4 (MEDIUM). The attack has no user interaction requirement but produces limited impact, compromising confidentiality and integrity while maintaining availability. The vulnerability affects all users who access pages containing injected shortcode content. EXPLOITATION STATUS The vulnerability currently shows low exploitation activity with no known public exploit code circulating. The EPSS score of 0.00032 indicates minimal real-world exploitation likelihood, and it is not listed on the CISA Known Exploited Vulnerabilities catalog. Community attention remains minimal, suggesting this poses a lower immediate threat despite the FAUCET risk score of 44.0/100.