Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and including, 0.2.6. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-5506 The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and including, 0.2.6. This is due to… https://www.cve.org/CVERecord?id=CVE-2026-5506
Post summary
The Wavr WordPress plugin is publicly disclosed to have a stored XSS vulnerability (CVE-2026-5506) affecting all versions up to 0.2.6, as noted in the linked CVE record.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-5506 - Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Intel Report: https://ift.tt/nLfGc1V
Post summary
A new vulnerability, CVE-2026-5506, has been disclosed as an authenticated stored XSS in Wavr <=0.2.6 via shortcode attributes.