PT-2026-26859
CVE-2026-3554
·
Published
2026-03-20
·
Updated
2026-03-31
Description by
CVSS 3.1
6.4
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Sherk Custom Post Type Displays plugin for WordPress versions up to and including 1.2.1
Description
The Sherk Custom Post Type Displays plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'title' shortcode attribute. This is a result of inadequate input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. The
sherkcptdisplays func() function in includes/SherkCPTDisplaysShortcode.php extracts the 'title' attribute value from shortcode atts() on line 19 and directly incorporates it into an HTML tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.
Recommendations
Versions prior to and including 1.2.1 should be updated to a newer, fixed version if available.
Found an issue in the description? Have something to add? Feel free to write us 👾