List Sub Pages
List Sub Pages has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for List Sub Pages has a vendor fix available, so running the current release closes it.
All of these findings were reported by Gilang - DJ. List Sub Pages is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-8290List Subpages <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
Read the full analysisVulnerability Records

List Sub Pages
Author
WeblineIndia
This plugin creates a “Sub Pages” Widget and also a dynamically generated “sub_page” shortcode with different parameters passing in it.Please find option available with this plugin for both “Sub Pages” Widget and “sub_page” shortcode. The plugin provides a shortcode generator page(Option Page) in which dynamic shortcode is generated simultaneously when you select your options from the options field. The selected values are passed as a shortcode parameters and everytime you visit the page you can generate the shortcode you want. Key Features Below are the options for displaying subpage if exists for that particular parent page. Title Displaying Sub Pages using a Sorting Order option. Below are the options to add effect in the parent pages display when subpages are not available to display. Displaying parent page as per Sorting Criteria Page Exclusion, to not show the title of specific pages. Depth Level, Parent Sort Order, displaying parent pages title link using a Sorting Order option. You can Copy the Dynamic Shortcode and paste where you want to display subpages or parent pages list. Dynamic Shortcode: e.g: [sub_page title=’Pages’ sort_order=’DESC’ sort_by_values=’ID’ exclude_page_id=’13’ depth=’2′ sort_order_parent=’DESC’ ] Note: This plugin will list the subpages for the current page being displayed, but if their is no childpage(subpage) for the current displaying page then it will display list of all the parent pages. If you don’t want to display some of the parent pages then also their is a feature in the plugin. Translation available in following languages English French Spanish Chinese
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C