Child Pages Card
Child Pages Card has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Child Pages Card has a vendor fix available, so running the current release closes it.
All of these findings were reported by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso. Child Pages Card is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-18395Child Pages Card <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Child Pages Card
Author
Katsushi Kawamori
Displays child page archives in card form Generated with shortcode Generated with block Can sort in ascending order and descending order. Specify the number of characters from the text and display the excerpt. Displays an featured image. If there is no featured image, a site icon is displayed, and if there is no site icon, a WordPress icon is displayed. Can specify the size of the displayed image. How it works Customize Template files allow for flexible customization. The default template file is template/childpagescard-template-html.php and template/childpagescard-template-css.php. Using this as a reference, you can specify a separate template file using the filters below. /** ================================================== * Filter for template file of html. * */ add_filter( 'child_pages_card_generate_template_html_file', function () { $wp_uploads = wp_upload_dir(); $upload_dir = wp_normalize_path( $wp_uploads['basedir'] ); $upload_dir = untrailingslashit( $upload_dir ); return $upload_dir . '/tmp/childpagescard-template-html.php'; }, 10, 1 ); /** ================================================== * Filter for template file of css. * */ add_filter( 'child_pages_card_generate_template_css_file', function () { $wp_uploads = wp_upload_dir(); $upload_dir = wp_normalize_path( $wp_uploads['basedir'] ); $upload_dir = untrailingslashit( $upload_dir ); return $upload_dir . '/tmp/childpagescard-template-css.php'; }, 10, 1 ); CSS files can be set separately. Please see the filters below. /** ================================================== * Filter for CSS file. * */ add_filter( 'child-pages-card_css_url', function () { $wp_uploads = wp_upload_dir(); $upload_url = $wp_uploads['baseurl']; if ( is_ssl() ) { $upload_url = str_replace( 'http:', 'https:', $upload_url ); } $upload_url = untrailingslashit( $upload_url ); return $upload_url . '/tmp/childpagescard.css'; }, 10, 1 );
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C