CVE-2026-4279: Bread & Butter WordPress Plugin XSS Flaw

CVE-2026-4279 Overview

The Bread & Butter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the breadbutter-customevent-button shortcode affecting all versions up to and including 8.2.0.25. The vulnerability stems from insufficient input sanitization and output escaping on the event shortcode attribute, allowing authenticated attackers with Contributor-level access or higher to inject malicious JavaScript that executes when users click the affected button.

Critical Impact

Authenticated attackers can inject persistent malicious scripts into WordPress pages, potentially leading to session hijacking, credential theft, or malware distribution when users interact with compromised content.

Affected Products

• Bread & Butter WordPress Plugin versions up to and including 8.2.0.25
• WordPress sites using the breadbutter-customevent-button shortcode
• Sites granting Contributor-level or higher access to untrusted users

Discovery Timeline

• 2026-04-22 - CVE-2026-4279 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4279

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the customEventShortCodeButton() function within the Bread & Butter plugin's shortcode handler. The function processes the event attribute from the breadbutter-customevent-button shortcode and directly interpolates the user-supplied value into a JavaScript string within an onclick HTML attribute. This direct interpolation occurs without proper sanitization using WordPress security functions such as esc_attr() or esc_js().

Notably, the plugin contains a sister function called customEventShortCode() that correctly implements esc_js() for the same attribute, demonstrating that the vulnerability results from an inconsistent security implementation rather than a fundamental design flaw. The button variant simply omitted the same security controls that were properly applied to the related function.

The vulnerability requires the attacker to have at least Contributor-level access to WordPress, meaning they must be able to create or edit posts that use shortcodes. Once the malicious payload is injected, it persists in the database and executes whenever any user accesses the page and clicks the injected button element.

Root Cause

The root cause is missing output escaping in the customEventShortCodeButton() function located in /src/Base/Shortcode.php. While the similar customEventShortCode() function at line 364 properly applies esc_js() to the event attribute, the button variant at line 380 fails to implement the same escaping. This inconsistency between two related functions handling the same type of user input represents a classic case of incomplete security implementation (CWE-79).

Attack Vector

The attack is executed via the network and requires authenticated access with at least Contributor privileges. The attacker crafts a malicious shortcode with JavaScript payload embedded in the event attribute, such as event handlers or script injection patterns. When the post is saved, the payload is stored in the WordPress database. Subsequently, when any user views the page and interacts with the rendered button, the injected JavaScript executes in their browser context, potentially enabling session theft, phishing overlays, or further exploitation.

The vulnerability mechanism involves the event attribute value being placed directly into an onclick attribute within the HTML output. Without proper escaping, an attacker can break out of the JavaScript string context and inject arbitrary script code that runs with the privileges of the victim user viewing the page.

Detection Methods for CVE-2026-4279

Indicators of Compromise

• Unusual or obfuscated content in posts using the breadbutter-customevent-button shortcode
• JavaScript code or HTML event handlers appearing in the event attribute of affected shortcodes
• Reports of unexpected browser behavior or pop-ups when users interact with plugin-generated buttons
• Suspicious post modifications by Contributor-level users containing encoded or escaped characters

Detection Strategies

• Review WordPress database for posts containing breadbutter-customevent-button shortcodes with suspicious event attribute values
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in shortcode attributes
• Monitor WordPress audit logs for unusual post editing activity by lower-privileged users
• Scan rendered HTML output for unexpected inline JavaScript within button onclick handlers

Monitoring Recommendations

• Enable WordPress activity logging for all post creation and modification events
• Configure SentinelOne Singularity to monitor for suspicious script execution patterns in browser contexts
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Regularly audit user privileges and remove unnecessary Contributor access

How to Mitigate CVE-2026-4279

Immediate Actions Required

• Update the Bread & Butter plugin to a patched version (when available)
• Review and audit all existing posts using the breadbutter-customevent-button shortcode for malicious content
• Temporarily disable the affected shortcode functionality if updates are not available
• Reduce the number of users with Contributor-level or higher access privileges

Patch Information

Review the plugin update status via the Wordfence Vulnerability Report for the latest patch information. The fix should involve adding proper output escaping using esc_js() in the customEventShortCodeButton() function, mirroring the secure implementation already present in customEventShortCode(). The vulnerable code can be reviewed at Shortcode.php line 380.

Workarounds

• Remove or disable the Bread & Butter plugin until a patch is available
• Use WordPress capability management plugins to restrict shortcode usage to trusted administrators only
• Implement server-side input validation to filter potentially malicious event attribute values
• Deploy a WAF rule to block requests containing XSS patterns in shortcode parameters

# WordPress CLI command to find potentially affected posts
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%breadbutter-customevent-button%' AND post_status = 'publish';"