CVE-2026-112111
CVE-2026-112111
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
CVSS 5.1 · Mittel · EPSS 0,4% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
bootstrap shortcodes
- Softwareversionen
- ≥ 0, < 3.4.6: Betroffen (semver)
Auf 3.4.6 aktualisieren
Originalquellen
- https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b
- https://wordpress.org/plugins/bootstrap-shortcodes/#developers
- https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6
- https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84
- https://wordpress.org/plugins/bootstrap-shortcodes/
- https://nvd.nist.gov/vuln/detail/CVE-2026-112111