List Sub Pages

List Sub Pages has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for List Sub Pages has a vendor fix available, so running the current release closes it.

All of these findings were reported by Gilang - DJ. List Sub Pages is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all List Sub Pages vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-8290

List Subpages <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

Read the full analysis

Vulnerability Records

1 records
List Sub Pages banner
Latestv1.0.8

List Sub Pages

WeblineIndia

Author

WeblineIndia

4.0(4)
80/100
Last Updated
2025-09-18 (1y ago)
Active Installs
400+
Downloads
13,038
Requires WP
3.2+
Requires PHP
7.4+
Tested up to
WP 6.8.8
Created
2014-02-08 (13y ago)

This plugin creates a “Sub Pages” Widget and also a dynamically generated “sub_page” shortcode with different parameters passing in it.Please find option available with this plugin for both “Sub Pages” Widget and “sub_page” shortcode. The plugin provides a shortcode generator page(Option Page) in which dynamic shortcode is generated simultaneously when you select your options from the options field. The selected values are passed as a shortcode parameters and everytime you visit the page you can generate the shortcode you want. Key Features Below are the options for displaying subpage if exists for that particular parent page. Title Displaying Sub Pages using a Sorting Order option. Below are the options to add effect in the parent pages display when subpages are not available to display. Displaying parent page as per Sorting Criteria Page Exclusion, to not show the title of specific pages. Depth Level, Parent Sort Order, displaying parent pages title link using a Sorting Order option. You can Copy the Dynamic Shortcode and paste where you want to display subpages or parent pages list. Dynamic Shortcode: e.g: [sub_page title=’Pages’ sort_order=’DESC’ sort_by_values=’ID’ exclude_page_id=’13’ depth=’2&#8242; sort_order_parent=’DESC’ ] Note: This plugin will list the subpages for the current page being displayed, but if their is no childpage(subpage) for the current displaying page then it will display list of all the parent pages. If you don’t want to display some of the parent pages then also their is a feature in the plugin. Translation available in following languages English French Spanish Chinese

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C