Bootstrap Shortcodes CVE-2026-112111

Exploitation requires an authenticated WordPress account with Contributor-level privileges or above (PR:L) on a site running the Bootstrap Shortcodes plugin before version 3.4.6, and the attacker must be able to author content using the plugin's [bs_tcontent] shortcode. The specific trigger is supplying a value containing a space character to the shortcode's id attribute, which the vulnerable bs_tcontent() handler in inc/bs_tabs.php emits into an UNQUOTED HTML attribute; esc_attr() does not encode spaces, so the space terminates the attribute and subsequent text is parsed as additional attributes including event handlers. Exploitation is LIMITED by: (1) the required Contributor-or-above authentication, narrowing attackers to semi-trusted users; (2) required victim user interaction - the injected event handler (e.g. onmouseover) must be triggered by a user viewing and interacting with the rendered element, so purely passive page loads may not fire it depending on the handler chosen; and (3) applicability only to the default vulnerable code path in versions prior to 3.4.6.

This is a genuinely medium-to-low priority issue, not an inflated high-CVSS item. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields a score of 5.1 (Medium), and every signal aligns with that modest rating: exploitation requires authenticated access at Contributor level or above (PR:L), and it requires victim interaction - the payload only fires when a user views AND interacts with the injected element (UI:P/Passive). Confidentiality impact is nil (VC:N) with only limited integrity/availability-of-page impact in the victim's browser context (VI:L, scope spill SC:L/SI:L). No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified, so there is no evidence of active or widespread exploitation. The key limiting factor is the trust barrier: Contributor-level accounts are already semi-trusted, which substantially narrows the realistic attacker population to insiders or compromised low-privilege accounts on multi-author sites. Source-code evidence (the fix commit adding quotes around the id attribute, plus a regression test) confirms the vulnerability mechanism with high confidence. Bottom line: a legitimate but not urgent issue - patch during normal maintenance, prioritize on multi-author WordPress sites that grant Contributor accounts to untrusted users.

An attacker holding a WordPress Contributor account (or who has compromised one) authors a post or page containing a [bs_tcontent id="x onmouseover=alert(document.cookie) ..."] shortcode, where a space in the id value breaks out of the unquoted HTML attribute and injects a JavaScript event handler. When an administrator or other visitor views the page and moves their mouse over the rendered tab element, the script executes in their browser session. No public proof-of-concept was identified, but the fix commit's regression test demonstrates the exact injection string, making the technique trivially reproducible.