CVE-2026-112111
CVE-2026-112111
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
CVSS 5.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
bootstrap shortcodes
- Versions
- ≥ 0, < 3.4.6: Affected (semver)
Update to 3.4.6
Original sources
- https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b
- https://wordpress.org/plugins/bootstrap-shortcodes/#developers
- https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6
- https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84
- https://wordpress.org/plugins/bootstrap-shortcodes/
- https://nvd.nist.gov/vuln/detail/CVE-2026-112111