Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Bootstrap Shortcodes plugin lets logged‑in users run scripts

CVE-2026-112111 · published today
Summary

The Bootstrap Shortcodes add‑on for WordPress versions earlier than 3.4.6 lets someone with a contributor or higher account add code that will run in any visitor’s web browser. This happens because the plugin does not properly clean a special tag’s identifier, allowing extra code to be injected. Update the plugin to the latest version or remove it to stop the risk.

What to do
  • Update bootstrap shortcodes project bootstrap shortcodes to version 3.4.6 or later.
Affected software
VendorProductAffected versions
bootstrap shortcodes project bootstrap shortcodes < 3.4.6
Original advisory text
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php em...
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
References
Severity
5.1 Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-112111 · NVD
CVE-2026-112111 · MITRE
Track software like this
Free during beta