CVE-2026-9677

Name of the Vulnerable Software and Affected Versions Shariff for WordPress versions prior to 1.0.12

Description The plugin fails to sanitize or escape the shariff infourl setting before it is output in the frontend HTML via the generateshariff() function. This flaw allows high-privilege users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks, which occurs when a malicious script is permanently stored on the target server and served to other users. This is possible even in environments where the unfiltered html capability is disabled, such as in multisite setups.

Recommendations Update Shariff for WordPress to version 1.0.12 or later.