EUVD-2026-59898
GHSA-fwgh-v8xw-qc79
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level access required (PR:L); scope changes to victim browser (S:C); no availability impact; network-delivered stored payload needs no further attacker interaction.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Snippet Shortcodes WordPress plugin (all versions through 5.2.0) allows any authenticated WordPress user with at least contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Once injected, the payload executes in the browser of any user who visits the affected page, including administrators, enabling session hijacking or privilege escalation. No active exploitation has been confirmed by CISA KEV, and no public exploit code is explicitly referenced in available intelligence; however, the Wordfence threat advisory and WordPress plugin trac source references document the vulnerability thoroughly.
Technical ContextAI
The affected component is the Snippet Shortcodes plugin for WordPress (vendor: aliakro; CPE: cpe:2.3:a:aliakro:snippet_shortcodes:*:*:*:*:*:*:*:*). CWE-79 identifies the root cause as improper neutralization of user-controllable input prior to output in a web page. Specifically, WordPress shortcode attributes supplied by contributors are passed through the plugin's rendering functions without adequate sanitization or contextual output escaping. The vulnerable logic is confirmed at includes/functions.php (line 81) and includes/shortcode.user.php (lines 14 and 74) in the 5.1.7 tag - accessible via WordPress plugin trac. Because shortcodes are rendered server-side and their output is written directly into page HTML, an attacker-controlled attribute value can introduce arbitrary JavaScript payloads that persist in the database and execute for every subsequent page visitor.
RemediationAI
Site administrators should update the Snippet Shortcodes plugin to the latest available version immediately. A code fix has been committed to the WordPress plugin repository (changeset 3647346 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3647346%40shortcode-variables&new=3647346%40shortcode-variables); however, the exact patched release version number is not confirmed in the available data and should be verified against the WordPress plugin directory before updating. If an immediate update is not possible, the primary compensating control is to remove contributor-level access from all untrusted users - this directly eliminates the attacker's required privilege. As a secondary measure, temporarily deactivating the plugin prevents shortcode rendering entirely at the cost of losing the plugin's functionality on affected pages. Blocking specific shortcode usage via a web application firewall rule targeting the plugin's shortcode tags is a narrower option but is difficult to maintain reliably. Full details are available from the Wordfence advisory linked above.
More in Snippet Shortcodes
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today