CVE-2026-9635 in WP Shortcode Plugin
Summary
by MITRE • 07/23/2026
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The WP Shortcode plugin by MyThemeShop presents a significant security vulnerability classified as stored cross-site scripting within its tab shortcode functionality. This flaw exists in versions up to and including 1.4.17, making it a persistent threat to WordPress installations that utilize this plugin. The vulnerability stems from inadequate input validation and output escaping mechanisms within the mts_tabs() function, which processes the title parameter of the [tab] shortcode. When an attacker with contributor-level privileges or higher submits malicious content through the title attribute, the system fails to sanitize this input before rendering it in the HTML output. The insecure implementation directly incorporates the unescaped title value between anchor tags in the generated HTML, creating a persistent XSS vector that can affect any user who accesses pages containing the maliciously injected content.
The technical exploitation of this vulnerability follows established patterns for stored XSS attacks where the malicious payload is stored on the server and executed when victims access affected pages. The mts_tabs() function serves as the primary attack surface since it handles the title parameter without applying appropriate escaping functions such as esc_attr() or htmlspecialchars() before outputting the content. This failure to implement proper input sanitization means that attackers can inject JavaScript code, HTML tags, or other malicious scripts that will execute in the context of other users' browsers. The vulnerability is particularly concerning because it requires only contributor-level access, which represents a relatively low privilege threshold for exploitation. This access level typically allows users to create and edit posts, making the attack vector more accessible than vulnerabilities requiring administrator privileges.
The operational impact of this stored XSS vulnerability extends beyond simple script execution, potentially enabling attackers to perform session hijacking, defacement of content, or redirection to malicious sites. When authenticated users browse pages containing the malicious tab shortcode, their browsers execute the injected scripts, which could steal cookies, redirect them to phishing sites, or modify page content. The persistent nature of stored XSS means that once the malicious payload is injected, it continues to affect all users who access the affected pages until the injection is removed from the database. This vulnerability affects the entire WordPress ecosystem where the plugin is installed, as the attack can propagate through any page that displays the tab shortcode with unescaped title attributes, potentially compromising user sessions and data integrity.
Security mitigations for this vulnerability should focus on immediate remediation efforts including updating to patched versions of the WP Shortcode plugin where available. Organizations must implement proper input validation and output escaping mechanisms throughout their WordPress installations, particularly when handling user-generated content through shortcodes or other dynamic elements. The implementation of Content Security Policy headers can provide additional protection against XSS attacks by limiting script execution sources. Regular security audits should verify that all plugins and themes properly sanitize user inputs before rendering them in HTML output. This vulnerability aligns with CWE-79 which describes cross-site scripting flaws, and represents a typical attack pattern that would be catalogued under ATT&CK technique T1566 for credential access through social engineering or malicious content delivery. Organizations should also consider implementing Web Application Firewalls to detect and block suspicious input patterns that could indicate attempted XSS exploitation attempts.