PT-2026-26859
CVE-2026-3554
·
Publicado
2026-03-20
·
Atualizado
2026-03-31
Descrição por
CVSS 3.1
6.4
MédiaMétricasAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Sherk Custom Post Type Displays plugin for WordPress versions up to and including 1.2.1
Description
The Sherk Custom Post Type Displays plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'title' shortcode attribute. This is a result of inadequate input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. The
sherkcptdisplays func() function in includes/SherkCPTDisplaysShortcode.php extracts the 'title' attribute value from shortcode atts() on line 19 and directly incorporates it into an HTML tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.
Recommendations
Versions prior to and including 1.2.1 should be updated to a newer, fixed version if available.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾