List Children
List Children has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for List Children has a vendor fix available, so running the current release closes it.
All of these findings were reported by Muhammad Yudha - DJ. List Children is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.
CVE-2025-4099List Children <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Read the full analysisVulnerability Records
List Children
Author
Andy Stratton
Use an HTML comment to list links of the current page’s children or siblings. Common usage is for content sites utilizing WordPress as a simple CMS. Some content hierarchies call for an Overview page followed by multiple subpages, for example, a Services page. Use the following shortcodes to list children and or siblings of the current page: Alphabetical listing of current page’s children: [list_children sort_column=”page_title” sort_order=”asc”] List of current page’s siblings, ordered by menu order (descending): [list_siblings sort_column=”menu_order” sort_order=”desc”] You can use a majority of the attributes from the wp_list_pages() call: https://codex.wordpress.org/Function_Reference/wp_list_pages The following will no longer work (deprecated): <ul> <!–list_children()–> </ul>
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C