CVE-2026-4005

Name of the Vulnerable Software and Affected Versions Coachific Shortcode versions prior to 1.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. The plugin uses sanitize text field() on the userhash shortcode attribute, which removes HTML tags but fails to escape characters critical to JavaScript string contexts, such as double quotes, semicolons, and parentheses. This sanitized value is directly interpolated into a JavaScript string within a <script> tag. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update the plugin to a version later than 1.0. As a temporary mitigation, avoid using the userhash attribute in shortcodes until the plugin is updated.