CVE-2026-112111: Bootstrap Shortcodes Plugin XSS Vulnerability

CVE-2026-112111 Overview

CVE-2026-112111 is a stored Cross-Site Scripting (XSS) vulnerability in the Bootstrap Shortcodes plugin for WordPress versions prior to 3.4.6. The flaw resides in the bs_tcontent() shortcode handler in inc/bs_tabs.php, which emits the id attribute value into an unquoted HTML attribute. While esc_attr() is applied, it does not encode space characters, allowing authenticated attackers to break out of the attribute context and inject arbitrary HTML, including JavaScript event handlers. Exploitation requires Contributor-level access or above, and the injected script executes in the browser of any user who views the affected page and interacts with the injected element [CWE-79].

Critical Impact
Authenticated contributors can inject stored JavaScript via the [bs_tcontent] shortcode id attribute, enabling session theft, administrative action hijacking, and malicious redirection against site visitors and administrators.

Affected Products

Bootstrap Shortcodes plugin for WordPress, all versions before 3.4.6
inc/bs_tabs.php component implementing the bs_tcontent shortcode handler
WordPress sites allowing Contributor-level or higher accounts to publish content containing the vulnerable shortcode

Discovery Timeline

2026-10-18 - CVE-2026-112111 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112111

Vulnerability Analysis

The Bootstrap Shortcodes plugin registers the [bs_tcontent] shortcode to render tabbed content panels. The handler in inc/bs_tabs.php accepts a user-controlled id attribute and emits that value directly into the generated HTML without wrapping it in quotes. The plugin applies WordPress's esc_attr() function to the value, which encodes characters such as <, >, ", and ', but does not encode whitespace.

Because the attribute is unquoted, a single space in the supplied id terminates the attribute token. Any content following the space is parsed by the browser as additional HTML attributes on the same element. Attackers can append event handlers such as onmouseover, onfocus, or onclick and attach arbitrary JavaScript payloads.

The payload persists in the WordPress database as stored post content and executes whenever a visitor interacts with the rendered element. Successful exploitation enables cookie theft, session hijacking, forced administrative actions through the WordPress REST API, and drive-by redirection to attacker-controlled infrastructure.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The handler assumes esc_attr() is sufficient for attribute encoding, but WordPress documentation specifies that esc_attr() output must be placed inside quoted attributes. Rendering the sanitized value without surrounding quotes breaks this contract and allows attribute-boundary escape.

Attack Vector

An authenticated user with Contributor privileges or higher creates or edits a post containing the [bs_tcontent] shortcode. The attacker supplies an id attribute value containing a space followed by an injected event handler and JavaScript payload. Once the post is published or previewed by another user, the malicious markup renders in the victim's browser and triggers on interaction with the injected element.

php

// Patch excerpt - inc/bs_tabs.php
// Source: https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b
 add_shortcode( 'bs_tab', 'bs_tab' );
 
 function bs_dropdown( $params, $content=null ) {
-    global $bs_timestamp;
     extract( shortcode_atts( array(
         'title' => '',
         'id' => '',

The upstream commit c26659c titled "fix(tabs): quote bs_tcontent id attribute" wraps the id output in quotation marks so that esc_attr() encoding provides the intended attribute-boundary protection.

Detection Methods for CVE-2026-112111

Indicators of Compromise

Post or page content containing [bs_tcontent] shortcodes with id attribute values that include whitespace followed by on* event handler names.
Rendered HTML output from the plugin containing unexpected attributes such as onmouseover=, onclick=, or onfocus= adjacent to the tab content wrapper element.
Outbound requests from visitor browsers to unknown third-party domains originating from pages that render Bootstrap Shortcodes content.
Newly created Contributor or Author accounts followed by edits to posts embedding [bs_tcontent] shortcodes.

Detection Strategies

Scan the wp_posts table for post_content values matching the regular expression \[bs_tcontent[^\]]*id="[^"]*\s+on\w+ to identify stored payloads.
Audit the installed plugin version through the WordPress admin or wp plugin list to confirm whether Bootstrap Shortcodes is below 3.4.6.
Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for inline script execution on pages that use the plugin.

Monitoring Recommendations

Monitor WordPress audit logs for post edits by Contributor-level accounts that introduce shortcode markup.
Alert on administrative session activity initiated immediately after a non-admin user previews or publishes content.
Track browser-side JavaScript errors and CSP violations on public pages for anomalies that may indicate injected handlers.

How to Mitigate CVE-2026-112111

Immediate Actions Required

Update the Bootstrap Shortcodes plugin to version 3.4.6 or later through the WordPress plugin dashboard or wp plugin update bootstrap-shortcodes.
Review and sanitize existing posts that use the [bs_tcontent] shortcode, removing any id values containing spaces or event handler syntax.
Rotate authentication cookies and secret keys defined in wp-config.php if evidence of exploitation is found.

Patch Information

The vendor fix is published in the GitHub release 3.4.6 and implemented in commit c26659c. The patch wraps the id attribute output in double quotes so that esc_attr() encoding fully contains user-controlled input. The plugin is distributed through the WordPress Plugin Directory.

Workarounds

Restrict Contributor and Author role assignments to trusted users until the patch is applied.
Temporarily deactivate the Bootstrap Shortcodes plugin on sites that cannot update immediately.
Deploy a web application firewall (WAF) rule that blocks POST requests to /wp-admin/post.php containing the pattern bs_tcontent combined with on\w+= in the body.
Enforce a strict Content Security Policy that disallows inline event handlers and inline scripts on front-end pages.

bash

# Update the plugin using WP-CLI
wp plugin update bootstrap-shortcodes --version=3.4.6

# Verify the installed version
wp plugin get bootstrap-shortcodes --field=version

# Identify stored payloads in post content
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '\\[bs_tcontent[^\\]]*id=\"[^\"]* on[a-z]+';"