CVE-2026-7661: WordPress Bootstrap Shortcode XSS Flaw

CVE-2026-7661 Overview

The Bootstrap Shortcode plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the box shortcode. The flaw affects all versions up to and including version 1.0. The plugin fails to properly sanitize input and escape output for user-supplied shortcode attributes [CWE-79].

Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript into WordPress pages. The injected scripts execute in the browser of any user who views the affected page, including administrators. This vulnerability is tracked in the Wordfence Vulnerability Intelligence Report.

Critical Impact
Authenticated contributors can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and administrative actions through forged requests.

Affected Products

WordPress Bootstrap Shortcode plugin versions 1.0 and earlier
WordPress sites with the plugin active and Contributor-level (or higher) user accounts
Any WordPress site rendering content authored by lower-privileged users through this plugin

Discovery Timeline

2026-05-12 - CVE-2026-7661 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-7661

Vulnerability Analysis

The Bootstrap Shortcode plugin registers a box shortcode that accepts attributes provided by content authors. The plugin embeds these attributes directly into the HTML output without applying WordPress sanitization functions such as esc_attr() or wp_kses(). As a result, attacker-controlled markup, including <script> tags and event handler attributes, persists in the rendered page.

When a visitor or administrator loads the page, the browser parses and executes the injected payload in the context of the WordPress site origin. Stored XSS persists across sessions because the payload lives in the post content within the database. Technical details are available in the WordPress Plugin Source Code.

Root Cause

The root cause is insufficient input validation and missing output escaping on shortcode attributes processed by the box handler. The plugin trusts the values supplied by post authors and concatenates them into HTML without context-aware escaping. WordPress requires shortcode developers to apply esc_attr() to attribute values and esc_html() or wp_kses_post() to inner content, which this plugin omits.

Attack Vector

An attacker requires a Contributor account or higher on the target WordPress site. The attacker authors a post or page containing a malicious box shortcode with crafted attributes that include JavaScript. After the content is published or previewed, any user who accesses the page triggers execution of the script. Successful exploitation can hijack administrator sessions, exfiltrate cookies, or perform privileged actions via the WordPress REST API. The EPSS score for this CVE is 0.029% (8.297 percentile), indicating low observed exploitation probability at this time.

No verified public proof-of-concept code is available. See the Wordfence advisory for additional technical context.

Detection Methods for CVE-2026-7661

Indicators of Compromise

Posts or pages containing [box] shortcodes with attribute values that include <script>, javascript:, or HTML event handlers such as onerror= and onload=
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts authored by lower-privileged users
New administrator accounts or modified user roles correlated with Contributor-authored content being viewed by privileged users

Detection Strategies

Query the wp_posts table for post content matching the pattern \[box[^\]]*(<script|on\w+=|javascript:) to identify injected payloads
Review WordPress audit logs for Contributor or Author accounts creating or editing posts that contain shortcode attributes with HTML special characters
Inspect web server access logs for administrator sessions loading posts immediately followed by anomalous XHR or fetch requests

Monitoring Recommendations

Enable detailed user activity logging through a WordPress audit plugin to record post revisions and shortcode usage by non-administrative roles
Forward WordPress and web server logs to a centralized SIEM and alert on suspicious shortcode attribute patterns
Monitor browser-side Content Security Policy (CSP) violation reports for blocked inline script executions on plugin-rendered pages

How to Mitigate CVE-2026-7661

Immediate Actions Required

Deactivate and remove the Bootstrap Shortcode plugin until a patched version is released by the vendor
Audit all existing posts and pages for malicious [box] shortcode attributes and remove or sanitize affected content
Restrict Contributor and Author role assignments and review the membership of these roles for unfamiliar accounts
Force a password reset for administrator accounts that may have viewed attacker-authored pages

Patch Information

At the time of publication, no fixed version of the Bootstrap Shortcode plugin is available. The vulnerability affects all versions up to and including 1.0. Check the WordPress Bootstrap Shortcode Plugin page for updates and apply any vendor-supplied patches as soon as they are released.

Workarounds

Remove the plugin entirely and replace its functionality with shortcodes from an actively maintained alternative that applies esc_attr() to user input
Restrict the publish_posts and edit_posts capabilities so that only trusted users can author content containing shortcodes
Deploy a web application firewall (WAF) rule that blocks requests containing [box combined with <script or event handler keywords in post body parameters
Implement a strict Content Security Policy that disallows inline scripts to limit the impact of stored payloads

bash

# Configuration example: disable the plugin via WP-CLI and search for injected payloads
wp plugin deactivate bootstrap-shortcode
wp plugin delete bootstrap-shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '\\[box[^\\]]*(<script|on[a-z]+=|javascript:)'"