CVE-2026-10024: TinyMCE Shortcode Addon XSS Vulnerability

CVE-2026-10024 Overview

CVE-2026-10024 is a Stored Cross-Site Scripting (XSS) vulnerability in the TinyMCE shortcode Addon plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.0. The vulnerability resides in the handling of the btnrel shortcode attribute, where insufficient input sanitization and output escaping allow script payloads to persist in rendered pages.

Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can store malicious JavaScript that runs against site visitors and administrators, enabling session theft, forced administrative actions, and content tampering.

Affected Products

TinyMCE shortcode Addon plugin for WordPress, all versions through 1.0.0
WordPress sites that permit contributor-level (or higher) accounts to author shortcode content
Any site rendering pages built with the btnrel shortcode attribute

Discovery Timeline

2026-06-09 - CVE-2026-10024 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-10024

Vulnerability Analysis

The TinyMCE shortcode Addon plugin exposes shortcodes that wrap user-supplied attributes into HTML output. The btnrel attribute is intended to populate the rel attribute of a generated anchor or button element. Because the plugin neither sanitizes the input nor escapes it before rendering, an attacker can break out of the attribute context and inject script content.

The vulnerability is exploitable by any authenticated user holding contributor privileges or higher. WordPress contributor accounts can author drafts that include shortcodes, and the malicious payload is stored in the database. When an editor, administrator, or site visitor previews or views the page, the injected script executes in their browser session.

Referenced source lines in shortcode-functions.php (line 50) and shortcode-functions.php (line 59) show where attribute values flow into output without escaping. Additional context is available in the Wordfence Vulnerability Analysis.

Root Cause

The root cause is missing output escaping on the btnrel shortcode attribute. WordPress provides esc_attr() for safely rendering values inside HTML attributes, but the plugin concatenates the attribute value directly into the output HTML. This allows quote-breaking payloads such as " onfocus=alert(1) autofocus=" to escape the attribute context.

Attack Vector

An attacker registers or compromises a WordPress account with contributor privileges. The attacker creates a post or page that includes the vulnerable shortcode with a crafted btnrel attribute carrying a JavaScript payload. After the post is saved, the payload is stored persistently. Execution occurs whenever any authenticated reviewer or unauthenticated visitor loads the page in a browser, enabling cookie theft, forced administrative requests, or drive-by redirects.

No verified proof-of-concept code is published. See the linked Wordfence advisory for technical details on the attribute-context break.

Detection Methods for CVE-2026-10024

Indicators of Compromise

Post or page content containing the vulnerable shortcode with btnrel values that include <, >, ", onerror=, onload=, onfocus=, or javascript: substrings
Unexpected <script> tags or inline event handlers appearing in rendered post HTML
Newly created contributor or author accounts followed by rapid content publication
Outbound browser requests from administrator sessions to unfamiliar external domains after viewing plugin-rendered pages

Detection Strategies

Query the wp_posts table for post_content containing the vulnerable shortcode and inspect btnrel attribute values for HTML metacharacters
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to wp-admin/post.php for shortcode payloads containing script-injection patterns
Monitor WordPress audit logs for contributor accounts publishing or editing content that uses the affected shortcode

Monitoring Recommendations

Enable WordPress activity logging covering post creation, post updates, and user role changes
Forward web server access logs and WordPress audit events to a centralized SIEM for correlation across content authoring and administrator browsing activity
Alert on Content Security Policy (CSP) violation reports indicating inline script execution from /wp-content/ rendered pages

How to Mitigate CVE-2026-10024

Immediate Actions Required

Deactivate the TinyMCE shortcode Addon plugin until a patched version is released and verified
Audit all existing posts and pages for use of the affected shortcode and remove or sanitize stored btnrel values
Review contributor, author, and editor accounts; remove inactive accounts and enforce strong authentication
Apply a restrictive Content Security Policy to limit inline script execution on rendered pages

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. All versions up to and including 1.0.0 remain vulnerable. Monitor the Wordfence Vulnerability Analysis and the WordPress plugin repository for an updated release.

Workarounds

Restrict contributor-level access and require editor review for any post containing shortcodes before publication
Use a WAF rule to block requests containing the affected shortcode with quote characters or on*= event handlers inside btnrel
Replace the plugin with an actively maintained shortcode plugin that uses esc_attr() for attribute output

bash

# Identify posts containing the vulnerable shortcode for manual review
wp db query "SELECT ID, post_title, post_status FROM wp_posts \
  WHERE post_content LIKE '%btnrel=%' \
  AND post_status IN ('publish','draft','pending');"

# Temporarily disable the plugin via WP-CLI
wp plugin deactivate 360crest-themeone-tinymce-shortcodes