Vulnerability · Published Oct 18, 2026 · Assigned by mitre
CVE-2026-112111
Medium 5.1
In plain English
A medium-severity cross-site scripting in Bootstrap Shortcodes from Bootstrap Shortcodes project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bootstrap Shortcodes project | Bootstrap Shortcodes | 0 – before 3.4.6 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b patch
- https://wordpress.org/plugins/bootstrap-shortcodes/#developers release-notes
- https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6 product
- https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84 technical-description
- https://wordpress.org/plugins/bootstrap-shortcodes/ product