CVE-2026-4067: Ad Short WordPress Plugin XSS Vulnerability

CVE-2026-4067 Overview

The Ad Short plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ad' shortcode's 'client' attribute affecting all versions up to and including 2.0.1. This vulnerability stems from insufficient input sanitization and output escaping on the 'client' shortcode attribute, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into WordPress pages.

Critical Impact
Authenticated attackers can inject malicious JavaScript that executes whenever any user accesses an affected page, potentially leading to session hijacking, credential theft, or malicious content injection.

Affected Products

Ad Short WordPress Plugin version 2.0.1 and earlier
WordPress installations using vulnerable Ad Short plugin versions

Discovery Timeline

2026-03-21 - CVE CVE-2026-4067 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4067

Vulnerability Analysis

The vulnerability exists in the Ad Short plugin's shortcode handler implementation. The ad_func() shortcode handler at line 71 of ad_short.php accepts a 'client' attribute through WordPress's shortcode_atts() function. This attribute value is then directly concatenated into a double-quoted HTML attribute (data-ad-client) at line 130 without any sanitization or escaping applied.

The absence of esc_attr() or equivalent output escaping functions allows attackers to break out of the HTML attribute context and inject arbitrary JavaScript code. Because this is a Stored XSS vulnerability, the malicious payload persists in the WordPress database and executes every time a visitor loads the affected page.

Root Cause

The root cause is improper output encoding classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to apply WordPress's built-in escaping functions like esc_attr() before outputting user-controlled data within HTML attributes. This architectural flaw allows attackers to inject malicious payloads that the browser interprets as executable code rather than data.

Attack Vector

This is a network-based attack requiring authentication at the Contributor level or higher. An attacker with sufficient WordPress privileges can create or edit a post containing the vulnerable 'ad' shortcode with a malicious 'client' attribute value. The payload is stored in the WordPress database and executed in the browser context of any user who views the page containing the injected shortcode.

The attack exploits the lack of sanitization in the shortcode attribute handling. When the ad_func() function processes the shortcode, the unsanitized 'client' attribute value is embedded directly into the HTML output, allowing JavaScript injection through attribute breakout techniques.

Detection Methods for CVE-2026-4067

Indicators of Compromise

Unexpected or suspicious content within posts or pages using the [ad] shortcode
Anomalous data-ad-client attribute values containing script tags, event handlers, or encoded JavaScript
User reports of unexpected JavaScript alerts, redirects, or pop-ups on WordPress pages
Browser security warnings or Content Security Policy violations on affected pages

Detection Strategies

Review WordPress database entries for posts containing the [ad] shortcode with suspicious 'client' attribute values
Implement Web Application Firewall (WAF) rules to detect XSS payloads in shortcode attributes
Monitor for JavaScript execution patterns consistent with stored XSS attacks
Audit user accounts with Contributor-level access or higher for suspicious activity

Monitoring Recommendations

Enable WordPress audit logging to track post and page modifications involving shortcodes
Configure browser security headers including Content-Security-Policy to limit script execution
Implement real-time monitoring for JavaScript injection patterns in rendered page content
Review access logs for authenticated users creating or modifying content with shortcodes

How to Mitigate CVE-2026-4067

Immediate Actions Required

Update the Ad Short plugin to a patched version when available
Audit existing content for malicious shortcode injections and remove any identified payloads
Review and restrict user accounts with Contributor-level access or above
Consider temporarily disabling the Ad Short plugin until a patch is released

Patch Information

Review the plugin source code at the WordPress Plugin Code Review for technical details on the vulnerable code path. Additional vulnerability information is available in the Wordfence Vulnerability Report. Monitor the plugin's official repository for security updates that implement proper output escaping using esc_attr() on the 'client' attribute.

Workarounds

Restrict shortcode usage permissions to only trusted Administrator accounts
Implement Content Security Policy headers to mitigate the impact of successful XSS exploitation
Deploy a Web Application Firewall with rules targeting XSS payloads in WordPress shortcode attributes
Manually sanitize existing shortcode content by reviewing and cleaning 'client' attribute values

bash

# Configuration example - Add CSP headers to wp-config.php or .htaccess
# Apache .htaccess example:
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"

# Restrict contributor capabilities (add to functions.php)
# remove_role('contributor');
# Or use a capability management plugin to limit post publishing