CVE-2026-3996

The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'width', 'height', 'src', 'title', 'description', 'game_url', 'main', and 'thumb', which are all directly concatenated into HTML output without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L14
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L32
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L35
• https://plugins.trac.wordpress.org/browser/wp-games-embed/tags/0.1/wp-games-embed.php#L41
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L14
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L32
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L35
• https://plugins.trac.wordpress.org/browser/wp-games-embed/trunk/wp-games-embed.php#L41
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8cc968-01a5-45b8-bee8-86c858f86514?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39951Cacti is an open source performance and fault management fra…8.8
• CVE-2026-39955Cacti is an open source performance and fault management fra…9.8
• CVE-2026-39956jq is a command-line JSON processor. In commits after 69785b…6.1
• CVE-2026-39957Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-39958oma is a package manager for AOSC OS. Prior to 1.25.2, oma-t…9.1
• CVE-2026-39959Tmds.DBus provides .NET libraries for working with D-Bus fro…7.1
• CVE-2026-39960Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.4
• CVE-2026-39961Aiven Operator allows you to provision and manage Aiven Serv…4.9
• CVE-2026-39962MISP is an open source threat intelligence and sharing platf…9.6
• CVE-2026-39963Serendipity is a PHP-powered weblog engine. In versions 2.6-…6.9
• CVE-2026-39964TypeBot is a chatbot builder tool. In versions prior to 3.16…5.4
• CVE-2026-39965TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…7.7