CVE-2026-4067: Ad Short WordPress Plugin XSS Vulnerability

CVE-2026-4067 Overview

The Ad Short plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ad' shortcode's 'client' attribute affecting all versions up to and including 2.0.1. This vulnerability stems from insufficient input sanitization and output escaping on the 'client' shortcode attribute, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into WordPress pages.

Critical Impact

Authenticated attackers can inject malicious JavaScript that executes whenever any user accesses an affected page, potentially leading to session hijacking, credential theft, or malicious content injection.

Affected Products

• Ad Short WordPress Plugin version 2.0.1 and earlier
• WordPress installations using vulnerable Ad Short plugin versions

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-4067 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4067

Vulnerability Analysis

The vulnerability exists in the Ad Short plugin's shortcode handler implementation. The ad_func() shortcode handler at line 71 of ad_short.php accepts a 'client' attribute through WordPress's shortcode_atts() function. This attribute value is then directly concatenated into a double-quoted HTML attribute (data-ad-client) at line 130 without any sanitization or escaping applied.

The absence of esc_attr() or equivalent output escaping functions allows attackers to break out of the HTML attribute context and inject arbitrary JavaScript code. Because this is a Stored XSS vulnerability, the malicious payload persists in the WordPress database and executes every time a visitor loads the affected page.

Root Cause

The root cause is improper output encoding classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to apply WordPress's built-in escaping functions like esc_attr() before outputting user-controlled data within HTML attributes. This architectural flaw allows attackers to inject malicious payloads that the browser interprets as executable code rather than data.

Attack Vector

This is a network-based attack requiring authentication at the Contributor level or higher. An attacker with sufficient WordPress privileges can create or edit a post containing the vulnerable 'ad' shortcode with a malicious 'client' attribute value. The payload is stored in the WordPress database and executed in the browser context of any user who views the page containing the injected shortcode.

The attack exploits the lack of sanitization in the shortcode attribute handling. When the ad_func() function processes the shortcode, the unsanitized 'client' attribute value is embedded directly into the HTML output, allowing JavaScript injection through attribute breakout techniques.

Detection Methods for CVE-2026-4067

Indicators of Compromise

• Unexpected or suspicious content within posts or pages using the [ad] shortcode
• Anomalous data-ad-client attribute values containing script tags, event handlers, or encoded JavaScript
• User reports of unexpected JavaScript alerts, redirects, or pop-ups on WordPress pages
• Browser security warnings or Content Security Policy violations on affected pages

Detection Strategies

• Review WordPress database entries for posts containing the [ad] shortcode with suspicious 'client' attribute values
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in shortcode attributes
• Monitor for JavaScript execution patterns consistent with stored XSS attacks
• Audit user accounts with Contributor-level access or higher for suspicious activity

Monitoring Recommendations

• Enable WordPress audit logging to track post and page modifications involving shortcodes
• Configure browser security headers including Content-Security-Policy to limit script execution
• Implement real-time monitoring for JavaScript injection patterns in rendered page content
• Review access logs for authenticated users creating or modifying content with shortcodes

How to Mitigate CVE-2026-4067

Immediate Actions Required

• Update the Ad Short plugin to a patched version when available
• Audit existing content for malicious shortcode injections and remove any identified payloads
• Review and restrict user accounts with Contributor-level access or above
• Consider temporarily disabling the Ad Short plugin until a patch is released

Patch Information

Review the plugin source code at the WordPress Plugin Code Review for technical details on the vulnerable code path. Additional vulnerability information is available in the Wordfence Vulnerability Report. Monitor the plugin's official repository for security updates that implement proper output escaping using esc_attr() on the 'client' attribute.

Workarounds

• Restrict shortcode usage permissions to only trusted Administrator accounts
• Implement Content Security Policy headers to mitigate the impact of successful XSS exploitation
• Deploy a Web Application Firewall with rules targeting XSS payloads in WordPress shortcode attributes
• Manually sanitize existing shortcode content by reviewing and cleaning 'client' attribute values

# Configuration example - Add CSP headers to wp-config.php or .htaccess
# Apache .htaccess example:
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"

# Restrict contributor capabilities (add to functions.php)
# remove_role('contributor');
# Or use a capability management plugin to limit post publishing