PT-2026-117162 · WordPress · Bootstrap Shortcodes
CVE-2026-112111
·
Published
2026-10-18
·
Updated
2026-10-19
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Bootstrap Shortcodes versions prior to 3.4.6
Description
Stored Cross-Site Scripting (XSS) occurs when the
bs tcontent() shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. Although esc attr() is used, it fails to encode space characters, allowing a space in the supplied value to terminate the attribute. This enables authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute in the browser of any user viewing the page and interacting with the injected element.Recommendations
Update to version 3.4.6 or later.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bootstrap Shortcodes