CVE-2026-3554: Sherk Custom Post Type Displays XSS Flaw

CVE-2026-3554 Overview

The Sherk Custom Post Type Displays plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the title shortcode attribute affecting all versions up to and including 1.2.1. The vulnerability stems from insufficient input sanitization and output escaping on the title attribute of the sherkcptdisplays shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute whenever users access the compromised page.

Critical Impact
Authenticated attackers can inject persistent malicious scripts that execute in victim browsers, potentially leading to session hijacking, credential theft, or malware distribution through compromised WordPress pages.

Affected Products

Sherk Custom Post Type Displays plugin for WordPress version 1.2.1 and earlier
WordPress installations using the sherkcptdisplays shortcode functionality
Any WordPress sites with Contributor-level or higher user accounts

Discovery Timeline

2026-03-21 - CVE CVE-2026-3554 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3554

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the sherkcptdisplays_func() function located in includes/SherkCPTDisplaysShortcode.php. The vulnerability allows authenticated attackers with at least Contributor-level privileges to inject malicious JavaScript code that persists in the WordPress database and executes in the context of victim browsers when they view the affected page.

The attack scope extends beyond the vulnerable component (Changed scope in CVSS terms), meaning successful exploitation can impact resources outside the security scope of the vulnerable plugin. This characteristic makes the vulnerability particularly dangerous as injected scripts run with the permissions of the viewing user, potentially including administrators.

Root Cause

The root cause of this vulnerability is the absence of proper output escaping when rendering user-supplied shortcode attribute values. Specifically, in the sherkcptdisplays_func() function:

The title attribute value is extracted from shortcode_atts() on line 19 of SherkCPTDisplaysShortcode.php
This value is directly concatenated into an HTML <h2> tag on line 31 without any escaping or sanitization

The plugin fails to apply WordPress's built-in escaping functions such as esc_html(), esc_attr(), or wp_kses() before outputting user-controlled data, allowing HTML and JavaScript injection.

Attack Vector

The attack is network-accessible and requires low privileges (Contributor-level WordPress access) with no user interaction needed for the initial injection. An attacker crafts a malicious shortcode within post content that includes JavaScript in the title attribute. When WordPress renders the page containing this shortcode, the injected script executes in visitors' browsers.

A typical attack scenario involves:

An attacker with Contributor access creates or edits a post
The attacker inserts a sherkcptdisplays shortcode with malicious JavaScript in the title attribute
When any user (including administrators) views the published page, the malicious script executes
The script can steal session cookies, perform actions as the victim, or redirect to malicious sites

The vulnerability can be exploited by embedding JavaScript event handlers or script tags within the title attribute value, which will be rendered without sanitization in the resulting HTML output.

Detection Methods for CVE-2026-3554

Indicators of Compromise

Presence of suspicious JavaScript or HTML tags within sherkcptdisplays shortcode title attributes in WordPress post content
Database entries in wp_posts table containing encoded or obfuscated script payloads within shortcode attributes
Unexpected outbound network connections originating from client browsers when viewing pages with the vulnerable shortcode
User reports of browser redirects, pop-ups, or unusual behavior when viewing specific WordPress pages

Detection Strategies

Audit WordPress post content database for shortcodes containing script tags, event handlers (e.g., onerror, onload, onclick), or encoded JavaScript in attribute values
Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to WordPress admin endpoints
Monitor browser console errors and network requests for signs of injected script execution
Review WordPress user activity logs for unusual content modifications by Contributor-level accounts

Monitoring Recommendations

Enable detailed logging for WordPress post creation and modification events, particularly for users with Contributor or Author roles
Deploy Content Security Policy (CSP) headers to detect and block inline script execution attempts
Implement real-time alerting for database queries containing common XSS payload patterns
Regularly scan stored content for malicious payloads using WordPress security plugins

How to Mitigate CVE-2026-3554

Immediate Actions Required

Audit all existing posts and pages for potentially malicious sherkcptdisplays shortcodes and remove any suspicious content
Consider temporarily disabling the Sherk Custom Post Type Displays plugin until a patched version is available
Review and restrict Contributor-level access to only trusted users who require posting capabilities
Implement Content Security Policy headers to mitigate the impact of any successful XSS exploitation

Patch Information

Monitor the WordPress Plugin Directory and Wordfence Vulnerability Report for updates from the plugin developer. A proper fix should implement output escaping using esc_html() on line 31 of SherkCPTDisplaysShortcode.php before concatenating the title attribute value into the HTML output.

Workarounds

Manually modify the plugin code to add esc_html() escaping around the title attribute output on line 31 of includes/SherkCPTDisplaysShortcode.php
Remove Contributor-level access from untrusted users to prevent exploitation
Use a WordPress security plugin to scan and sanitize post content for XSS payloads
Implement server-side input validation using a WAF rule to block requests containing script tags in shortcode attributes

bash

# Configuration example: Add to wp-config.php or .htaccess for additional CSP protection
# Add Content Security Policy header to mitigate XSS impact
# In .htaccess (Apache):
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"

# Or in wp-config.php (add before "That's all, stop editing!"):
# header("Content-Security-Policy: script-src 'self'; object-src 'none';");

# To temporarily disable the plugin via WP-CLI:
wp plugin deactivate sherk-custom-post-type-displays

# Search for potentially malicious shortcodes in database:
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%sherkcptdisplays%script%' OR post_content LIKE '%sherkcptdisplays%onerror%'"