CVE-2026-9635

Name of the Vulnerable Software and Affected Versions WP Shortcode by MyThemeShop versions prior to 1.4.18

Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping within the mts tabs() function, which directly outputs the title parameter of the [tab] shortcode into the HTML between anchor tags. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites, executing in the browser of the user who visits the affected page.

Recommendations Update the plugin to a version later than 1.4.17. As a temporary mitigation, restrict the use of the title parameter within the [tab] shortcode or limit user permissions to prevent contributors from editing pages containing this shortcode.