VulnSocial

CVE-2026-3005Disclosure

LOWCVSS 6.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.94.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 3 mentions (2026-04-09); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-09: 3Mentions · 2026-04-20: 1PoC Mentioned / Linked · 2026-04-20: 1Exploit Tool / Code · 2026-04-20: 1Technical Details · 2026-04-09: 304-0904-20
Signal classification2 categories
Disclosure
375.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-093
Disclosure3
2026-04-201
PoC1
Full discourse4 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-3005-list-category-posts-version-0-94-0-medium-vulnerability-proof-of-concept CVE-2026-3005 #WordPress plugin #vulnerability list-category-posts #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge

    Post summary

    A proof-of-concept for CVE‑2026‑3005 targeting WordPress "list-category-posts" v0.94.0 is available, but no evidence of active exploitation or patch information is provided.

    0000060
    6 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-3005 The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.9… https://www.cve.org/CVERecord?id=CVE-2026-3005 ----- Traducción: CVE-2026-3005 El … http://infoflow.cloud`

    Post summary

    CVE-2026-3005 is disclosed as a stored cross‑site scripting vulnerability in the WordPress plugin’s catlist shortcode, affecting all versions up to 0.9.

    0000033
    67 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-3005 The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.9… https://www.cve.org/CVERecord?id=CVE-2026-3005

    Post summary

    The WordPress "The List category posts" plugin is vulnerable to stored XSS via the 'catlist' shortcode in all versions up to 0.9. No exploitation details or patch information are provided.

    00000140
    57.0K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3005 - List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode Intel Report: https://ift.tt/KWc8v4R

    Post summary

    The tweet discloses CVE-2026-3005, a stored XSS vulnerability affecting version 0.94.0 and earlier, exploitable via the 'catlist' shortcode by authenticated authors; no patch, exploit, or active use details are noted.

    0000041
    280 followersView on X

Explore more

Back to dashboard