CVE-2026-4083

Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

View on CVE.org
Published Mar 20, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and including, 1.2. The shortcode function sfhg_shortcode() allows arbitrary HTML attributes to be added to the rendered <iframe> element, with only a small blacklist of four attribute names (same_height_as, onload, onpageshow, onclick) being blocked. While the attribute names are passed through esc_html() and values through esc_attr(), this does not prevent injection of JavaScript event handler attributes like onfocus, onmouseover, onmouseenter, etc., because these attribute names and simple JavaScript payloads contain no characters that would be modified by these escaping functions. The shortcode text is stored in post_content and is only expanded to HTML at render time, after WordPress's kses filtering has already been applied to the raw post content. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

AI-generated

Technical impact

The Scoreboard for HTML5 Games Lite plugin for WordPress stores the result of its shortcode directly in post content. The shortcode handler accepts arbitrary HTML attributes on the rendered iframe element, and only a limited blacklist is applied. Escaping functions do not neutralise attribute names that trigger JavaScript events such as onfocus or onmouseover. Consequently an attacker who can edit a post can inject script payloads that execute whenever any visitor views the page, providing typical XSS capabilities such as session theft or defacement.

Affected Systems

All installations of the Scoreboard for HTML5 Games Lite plugin by demonisblack running WordPress, for every version up to and including 1.2. The vulnerability exists in the plugin code that generates the iframe element, regardless of the underlying WordPress version.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. Exploitation requires authenticated access at the Contributor level or higher, but no additional privileges are needed beyond the ability to edit post content. The lack of EPSS data and absence from the KEV catalog suggests that while the vulnerability is known, the current probability of exploitation is uncertain. Given that the payload runs client-side on all page viewers, the risk to sites with contributors is significant, especially if they host sensitive content or logged-in users.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Scoreboard for HTML5 Games Lite plugin to the latest available version (or remove the plugin if an upgrade is not feasible).
  • Revoke Contributors’ ability to edit posts that include the scoreboard shortcode or reduce their capabilities to the minimum required.
  • Audit existing posts for rogue shortcode attributes and correct or remove any malicious content.
  • Consider applying a web application firewall rule that blocks iframe attributes containing event handler names such as onfocus or onmouseover.

Generated by OpenCVE AI on March 21, 2026 at 07:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Demonisblack
Demonisblack scoreboard For Html5 Games Lite
Wordpress
Wordpress wordpress
Vendors & Products Demonisblack
Demonisblack scoreboard For Html5 Games Lite
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and including, 1.2. The shortcode function sfhg_shortcode() allows arbitrary HTML attributes to be added to the rendered <iframe> element, with only a small blacklist of four attribute names (same_height_as, onload, onpageshow, onclick) being blocked. While the attribute names are passed through esc_html() and values through esc_attr(), this does not prevent injection of JavaScript event handler attributes like onfocus, onmouseover, onmouseenter, etc., because these attribute names and simple JavaScript payloads contain no characters that would be modified by these escaping functions. The shortcode text is stored in post_content and is only expanded to HTML at render time, after WordPress's kses filtering has already been applied to the raw post content. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:53 PM
Reserved
Mar 12, 2026, 8:47 PM

View source JSON

Updated
Mar 24, 2026, 3:24 PM

JSON

Status
Deferred
Published
Mar 21, 2026, 12:16 AM
Modified
Jun 17, 2026, 10:55 AM

View source JSON

No data.

Updated
Mar 25, 2026, 2:33 PM

JSON