CVE-2026-9635: WP Shortcode Plugin XSS Vulnerability

CVE-2026-9635 Overview

CVE-2026-9635 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcode by MyThemeShop plugin for WordPress. The flaw affects all versions up to and including 1.4.17. The vulnerability resides in the mts_tabs() function, which fails to sanitize input or escape output for the title parameter of the [tab] shortcode. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes when visitors load an affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browsers of all visitors, enabling session theft, account takeover, and administrative privilege escalation.

Affected Products

WP Shortcode by MyThemeShop plugin for WordPress
Versions up to and including 1.4.17
The vulnerable mts_tabs() function in wp-shortcode.php

Discovery Timeline

2026-07-23 - CVE-2026-9635 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9635

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw introduced by the [tab] shortcode handler. When WordPress renders a post or page containing the shortcode, the mts_tabs() function reads the title attribute supplied by the author and writes it directly into the HTML output between anchor (<a>) tags. No escaping helpers such as esc_html(), esc_attr(), or wp_kses() are applied before the value is emitted.

Because contributors can save posts containing shortcodes, an attacker with a low-privilege authenticated account can plant a malicious payload in a draft. When an editor, administrator, or site visitor renders the page, the injected script executes in their browser context. This enables theft of authentication cookies, forced actions via the WordPress REST API, and pivoting to administrator accounts.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the mts_tabs() function of wp-shortcode.php. User-controlled shortcode attributes are concatenated into the rendered HTML without contextual encoding. Refer to the source lines at line 766 and line 774 for the affected code paths.

Attack Vector

An authenticated attacker with contributor-level permissions creates a post containing a [tab] shortcode where the title attribute holds a JavaScript payload, for example a <script> tag or an event handler such as onmouseover. The stored payload executes in the browser of any user who views the rendered page, including higher-privileged administrators. The scope-changed CVSS vector reflects the ability to impact users beyond the attacker's privilege boundary. Additional analysis is available from the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-9635

Indicators of Compromise

Posts or pages containing [tab] shortcodes with title attributes that include HTML tags, <script> blocks, or JavaScript event handlers such as onerror and onmouseover.
New or modified posts authored by contributor-level accounts that suddenly contain shortcode markup.
Outbound requests from visitor browsers to unfamiliar domains after loading pages that use the WP Shortcode plugin.

Detection Strategies

Query the wp_posts table for post_content values matching patterns such as [tab title="*<*"] or [tab title="*javascript:*"].
Review web server access logs for spikes in requests to pages authored by low-privileged users.
Use a Web Application Firewall (WAF) to inspect saved post content for HTML or script fragments inside shortcode attributes.

Monitoring Recommendations

Monitor role changes and privilege escalations following visits by administrators to contributor-authored pages.
Alert on the creation or modification of administrator accounts and application passwords via the WordPress REST API.
Track browser-side errors and Content Security Policy (CSP) violation reports for evidence of injected scripts.

How to Mitigate CVE-2026-9635

Immediate Actions Required

Update the WP Shortcode by MyThemeShop plugin to a version later than 1.4.17 once a patched release is available.
Audit all posts and pages containing [tab] shortcodes and remove any suspicious title attribute values.
Restrict contributor and author account creation, and review existing low-privileged accounts for signs of abuse.

Patch Information

No vendor patch reference is available in the CVE record at the time of publication. Monitor the WordPress plugin repository and the Wordfence advisory for release updates. Until a fix is published, treat the plugin as vulnerable in all versions up to and including 1.4.17.

Workarounds

Deactivate and remove the WP Shortcode by MyThemeShop plugin if a patched version is not yet available.
Deploy a WAF rule that blocks shortcode attributes containing angle brackets, javascript: URIs, or event-handler substrings.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads.
Limit contributor and author roles to trusted users, and require editor review before content is published.

bash

# Example CSP header to reduce stored XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"