Child Pages Card

Child Pages Card has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Child Pages Card has a vendor fix available, so running the current release closes it.

All of these findings were reported by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso. Child Pages Card is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Child Pages Card vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-18395

Child Pages Card <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv2.07

Child Pages Card

Katsushi Kawamori

Author

Katsushi Kawamori

4.0(2)
80/100
Last Updated
2026-03-29 (5mo ago)
Active Installs
80+
Downloads
5,664
Requires WP
6.6+
Requires PHP
8.0+
Tested up to
WP 7.0.4
Created
2019-11-10 (7y ago)

Displays child page archives in card form Generated with shortcode Generated with block Can sort in ascending order and descending order. Specify the number of characters from the text and display the excerpt. Displays an featured image. If there is no featured image, a site icon is displayed, and if there is no site icon, a WordPress icon is displayed. Can specify the size of the displayed image. How it works Customize Template files allow for flexible customization. The default template file is template/childpagescard-template-html.php and template/childpagescard-template-css.php. Using this as a reference, you can specify a separate template file using the filters below. /** ================================================== * Filter for template file of html. * */ add_filter( 'child_pages_card_generate_template_html_file', function () { $wp_uploads = wp_upload_dir(); $upload_dir = wp_normalize_path( $wp_uploads['basedir'] ); $upload_dir = untrailingslashit( $upload_dir ); return $upload_dir . '/tmp/childpagescard-template-html.php'; }, 10, 1 ); /** ================================================== * Filter for template file of css. * */ add_filter( 'child_pages_card_generate_template_css_file', function () { $wp_uploads = wp_upload_dir(); $upload_dir = wp_normalize_path( $wp_uploads['basedir'] ); $upload_dir = untrailingslashit( $upload_dir ); return $upload_dir . '/tmp/childpagescard-template-css.php'; }, 10, 1 ); CSS files can be set separately. Please see the filters below. /** ================================================== * Filter for CSS file. * */ add_filter( 'child-pages-card_css_url', function () { $wp_uploads = wp_upload_dir(); $upload_url = $wp_uploads['baseurl']; if ( is_ssl() ) { $upload_url = str_replace( 'http:', 'https:', $upload_url ); } $upload_url = untrailingslashit( $upload_url ); return $upload_url . '/tmp/childpagescard.css'; }, 10, 1 );

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C