List categories

List categories has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for List categories has a vendor fix available, so running the current release closes it.

All of these findings were reported by Krzysztof Zając. List categories is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all List categories vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-4356

List categories <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Read the full analysis

Vulnerability Records

1 records
List categories banner
Latestv0.5

List categories

Fernando Briano

Author

Fernando Briano

4.5(15)
90/100
Last Updated
2025-05-15 (1y ago)
Active Installs
5,000+
Downloads
77,268
Requires WP
3.3+
Requires PHP
0+
Tested up to
WP 6.8.8
Created
2014-06-26 (12y ago)

Simple plugin to display categories in any post or page with a shortcode. It’s basically a shortcode API interface to the wp_list_categories WordPress function. This means given any of the parameters accepted by the function, you can pass it in as a shortcode parameter to the categories shortcode. Usage: [categories orderby=count] Will display links to all the categories and order them by number of posts in each category. You can also list tags or any other WordPress taxonomy. You need to pass a value to the taxonomy parameter. For example to list tags: [categories taxonomy=post_tag title_li="Tags"]. By default, the usage shows: No link to all categories Sorts the list of Categories by the Category name in ascending order Displayed in an unordered list style Does not show the post count Displays only Categories with posts Sets the title attribute to the Category Description Is not restricted to the child_of any Category No feed or feed image used Does not exclude any Category and includes all Categories Displays the active Category with the CSS Class-Suffix &#8216; current-cat’ Shows the Categories in hierarchical indented fashion Display Category as the heading over the list No SQL LIMIT is imposed (&#8216;number’ => 0 is not shown above) Displays (echos) the categories No limit to depth All categories. The list is rendered using a new walker object of the the Walker_Category class See wp_list_categories for usage. Markup and Styling of Category Lists Taken from the wp_list_categories official documentation. By default, wp_list_categories() generates nested unordered lists (ul) within a single list item (li) titled “Categories”. You can remove the outermost item and list by setting the title_li parameter to an empty string. You’ll need to wrap the output in an ordered list (ol) or unordered list yourself (see the examples above). If you don’t want list output at all, set the style parameter to none. You can style the output with these CSS selectors : li.categories { ... } /* outermost list item */ li.cat-item { ... } li.cat-item-7 { ... } /* category ID #7, etc */ li.current-cat { ... } li.current-cat-parent { ... } ul.children { ... } For instance, you can remove the bullet points next to each category with: .cat-item { list-style-type: none } Show categories list in columns For outputting the list into columns, you can use CSS’s multicolumns. Since by default the list is printed as an unordered list with the “categories” class, you can add this to your CSS: .categories{ column-count: 5; column-gap: 50px; }

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C