Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Bootstrap Shortcodes project

    CVE-2026-112111 (GCVE-0-2026-112111)

    Vulnerability from nvd – Published: 2026-10-18 22:39 – Updated: 2026-10-19 16:20
    VLAI
    Summary
    The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-19 16:20 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2348 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Bootstrap Shortcodes project Bootstrap Shortcodes Affected: 0 , < 3.4.6 (semver)
        cpe:2.3:a:bootstrap_shortcodes_project:bootstrap_shortcodes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112111",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T16:20:27.998417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T16:20:39.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "modules": [
            "bs_tcontent shortcode"
          ],
          "packageName": "bootstrap-shortcodes",
          "product": "Bootstrap Shortcodes",
          "programFiles": [
            "inc/bs_tabs.php"
          ],
          "programRoutines": [
            {
              "name": "bs_tcontent shortcode"
            }
          ],
          "repo": "https://github.com/TheWebShop/bootstrap-shortcodes",
          "vendor": "Bootstrap Shortcodes project",
          "versions": [
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The attacker needs a WordPress account with the Contributor role or higher on a site with the plugin active. Contributor-authored content is executed\u0026nbsp;once an Editor or Administrator publishes it.\u003cbr\u003e"
            }
          ],
          "value": "The attacker needs a WordPress account with the Contributor role or higher on a site with the plugin active. Contributor-authored content is executed\u00a0once an Editor or Administrator publishes it."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bootstrap_shortcodes_project:bootstrap_shortcodes:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-18T22:50:27.148Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://wordpress.org/plugins/bootstrap-shortcodes/#developers"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/bootstrap-shortcodes/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the Bootstrap Shortcodes plugin to version 3.4.6 or later.\u003cbr\u003e"
            }
          ],
          "value": "Update the Bootstrap Shortcodes plugin to version 3.4.6 or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode.\u003cbr\u003e"
            }
          ],
          "value": "Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-112111",
    "datePublished": "2026-10-18T22:39:46.933Z",
    "dateReserved": "2026-10-18T22:39:46.301Z",
    "dateUpdated": "2026-10-19T16:20:39.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-112111 (GCVE-0-2026-112111)

    Vulnerability from cvelistv5 – Published: 2026-10-18 22:39 – Updated: 2026-10-19 16:20
    VLAI
    Summary
    The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-19 16:20 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2348 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Bootstrap Shortcodes project Bootstrap Shortcodes Affected: 0 , < 3.4.6 (semver)
        cpe:2.3:a:bootstrap_shortcodes_project:bootstrap_shortcodes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112111",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T16:20:27.998417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T16:20:39.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "modules": [
            "bs_tcontent shortcode"
          ],
          "packageName": "bootstrap-shortcodes",
          "product": "Bootstrap Shortcodes",
          "programFiles": [
            "inc/bs_tabs.php"
          ],
          "programRoutines": [
            {
              "name": "bs_tcontent shortcode"
            }
          ],
          "repo": "https://github.com/TheWebShop/bootstrap-shortcodes",
          "vendor": "Bootstrap Shortcodes project",
          "versions": [
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The attacker needs a WordPress account with the Contributor role or higher on a site with the plugin active. Contributor-authored content is executed\u0026nbsp;once an Editor or Administrator publishes it.\u003cbr\u003e"
            }
          ],
          "value": "The attacker needs a WordPress account with the Contributor role or higher on a site with the plugin active. Contributor-authored content is executed\u00a0once an Editor or Administrator publishes it."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bootstrap_shortcodes_project:bootstrap_shortcodes:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-18T22:50:27.148Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://wordpress.org/plugins/bootstrap-shortcodes/#developers"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/bootstrap-shortcodes/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the Bootstrap Shortcodes plugin to version 3.4.6 or later.\u003cbr\u003e"
            }
          ],
          "value": "Update the Bootstrap Shortcodes plugin to version 3.4.6 or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode.\u003cbr\u003e"
            }
          ],
          "value": "Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-112111",
    "datePublished": "2026-10-18T22:39:46.933Z",
    "dateReserved": "2026-10-18T22:39:46.301Z",
    "dateUpdated": "2026-10-19T16:20:39.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}