Microtango
Microtango has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Microtango has a vendor fix available, so running the current release closes it.
All of these findings were reported by Muhammad Yudha - DJ. Microtango is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.0.
CVE-2026-1821Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Read the full analysisVulnerability Records

Microtango
Author
microtango
Microtango integrates the Microtango REST API into WordPress. Features include: Provides three shortcodes: mt_courses, mt_reservation and mt_video. Usage: [mt_courses] or [mt_courses webcategory=”WTP2″] or [mt_courses webcategory=”WTP2″ orderby=”StartWeekday, Name”] or [mt_courses webcategory=”WTP1″]Kursname|{{Subject}} ({{Name}})#Tag / Zeit|{{StartWeekdayText}} {{Timespan}}#Startdatum|{{StartDateText}}#|{{AttendButton}}[/mt_courses] or [mt_courses webcategory=”WTP1″]Kursname|{{Subject}} ({{Name}})#1. Termin|{{DatesText.[0]}}#2. Termin|{{DatesText.[1]}}#3. Termin|{{DatesText.[2]}}#|{{AttendButton}}[/mt_courses] [mt_reservation] [mt_video] or [mt_video videogroup=”GK”] mt_courses parameters: mtattendform (optional): Use the built-in Microtango attend form. Values: popup (default) or standalone. webcategory (optional): Web category filter. orderby (optional): Sort order. template (optional): 1-9, selects one of the additional templates. templateid (optional): ID of the HTML template. category (optional): Category filter. attendurl (optional): URL for the attend form. Content [mt_courses] ... [/mt_courses]: Defines the table columns in the format: Column title | {{FieldName}}#Column title | {{FieldName}} Default: Course|{{Subject}}#Start|{{StartDateText}}#From|{{Timespan}}#Lessons|{{RepeatCount}}#Availability|{{AvailabilityText}}#|{{AttendButton}} FieldName: Values from the Microtango REST API (https://api.microtango.de/swagger -> RESTCourseModel). Possible values: * Id: adea471d-d109-416f-9638-5362b490b37a * Season: 21-1 * Name: 3TK-06 * Subject: Paare Tanzkreis Fr * StartDate: 2021-01-01T00:00:00 * StartDateText: 01.01.2021 * StartTime: 20:30:00 * StartTimeText: 20:30 * StartWeekday: 5 * StartWeekdayText: Freitag * StartMonthText: Januar * EndDate: 2021-12-24T00:00:00 * EndDateText: 24.12.2021 * EndTime: 21:30:00 * EndTimeText: 21:30 * EndWeekday: 5 * EndWeekdayText: Freitag * EndMonthText: Dezember * Timespan: 20:30 – 21:30 * Length: 1 Stunde * TimeCondition: wöchentlich 1 Stunde * Price: 0 * PriceClub: 35 * PriceText: 35,00 * PriceTextFull: 35,00 € monatlich * HallName: Großer Saal * HallAddress: Testweg 1, 12345 Musterhausen * TeacherName: Dr. Sch. Nitzel * AssistantName: Ein Name * ProgramName: Grundkurs 1 * Category: GK * WebCategory: Grundkurs1 * Availability: G, Y or R * AvailabilityText: Plätze verfügbar, Wenig Plätze verfügbar, Ausgebucht * RepeatCount: 12 * SkipDays: 7 * WebNotes: Sonstige Informationen * AttendFormShowPartner: true * AttendFormShowLegalGuardian: false * FreeText1, FreeText2, FreeText3, FreeText4, FreeText5, FreeText6, FreeText7, FreeText8, FreeText9 * DatesText.[x]: 04.05.2023 (x= 0 – RepeatCount) * Dates.[x]: 2023-05-04T18:00:00 (x= 0 – RepeatCount) Special fields: * Attend: Generates the attend link. * AttendButton: Generates an attend button (includes booked information). * ScheduleInfo: Shows a popup with the timetable. Example: [mt_courses] or [mt_courses webcategory=”WTP2″] or [mt_courses webcategory=”WTP2″ orderby=”StartWeekday, Name”] or [mt_courses webcategory=”WTP1″]Kursname|{{Subject}}{{Name}}#Tag / Zeit|{{StartWeekdayText}} {{Timespan}}#Startdatum|{{StartDateText}}#|{{Attend}}[/mt_courses] mt_reservation: Shows the online reservation form for customers. mt_video: Shows the available videos for customers. Example: [mt_video videogroup=”GK”] [mt_video videogroup=”GK”, videoPublic=true]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C