Description
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
Published: 2026-10-18
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (client‑side)
Action: Apply Patch
AI Analysis

Impact

The Bootstrap Shortcodes plugin for WordPress versions prior to 3.4.6 is vulnerable to stored client‑side script injection through the [bs_tcontent] shortcode. The plugin emits the id attribute value unquoted, and although esc_attr() is applied, it fails to encode space characters. A space terminates the attribute, allowing subsequent text to be parsed as new attributes, including JavaScript event handlers. Authenticated attackers with Contributor‑level or higher privileges can insert arbitrary scripts that run in the browsers of any site visitor who views the page containing the malicious shortcode.

Affected Systems

The vulnerability affects all WordPress sites that have the Bootstrap Shortcodes plugin installed and activated with a version earlier than 3.4.6. This includes any production or development site using the plugin, regardless of specific theme or WordPress core version. Site administrators should verify the installed plugin version and any existing content that uses the [bs_tcontent] shortcode.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium impact. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires authenticated access to content creation, so the attack vector is local to site administrators or contributors with sufficient privileges. Nonetheless, any injected script can compromise the confidentiality and integrity of site sessions and exfiltrate sensitive data from affected visitors.

Generated by OpenCVE AI on October 19, 2026 at 00:24 UTC.

Remediation

Vendor Solution

Update the Bootstrap Shortcodes plugin to version 3.4.6 or later.

Vendor Workaround

Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode.

OpenCVE Recommended Actions

  • Upgrade the Bootstrap Shortcodes plugin to version 3.4.6 or later to eliminate the vulnerability.
  • If an immediate update is not feasible, deactivate the plugin or restrict Contributor/Author users from publishing content that includes the [bs_tcontent] shortcode.
  • Review existing posts and pages for the [bs_tcontent] shortcode with untrusted id values and remove or sanitize them.

Generated by OpenCVE AI on October 19, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions bootstrap Shortcodes
Vendors & Products Wordpress-extensions
Wordpress-extensions bootstrap Shortcodes

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Stored XSS via unquoted id attribute in Bootstrap Shortcodes [bs_tcontent]

Sun, 18 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
First Time appeared Bootstrap Shortcodes Project
Bootstrap Shortcodes Project bootstrap Shortcodes
Weaknesses CWE-79
CPEs cpe:2.3:a:bootstrap_shortcodes_project:bootstrap_shortcodes:*:*:*:*:*:*:*:*
Vendors & Products Bootstrap Shortcodes Project
Bootstrap Shortcodes Project bootstrap Shortcodes
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Bootstrap Shortcodes Project Bootstrap Shortcodes
Wordpress-extensions Bootstrap Shortcodes
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-19T16:20:39.966Z

Reserved: 2026-10-18T22:39:46.301Z

Link: CVE-2026-112111

cve-icon Vulnrichment

Updated: 2026-10-19T16:20:34.339Z

cve-icon NVD

Status : Deferred

Published: 2026-10-18T23:16:56.583

Modified: 2026-10-19T21:14:14.150

Link: CVE-2026-112111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:01:46Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')