EUVD-2026-14157
GHSA-m3x9-6r4v-vvcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in all versions up to and including 1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the avp_texttoggle_part_shortcode() function, the 'title' attribute is extracted from shortcode attributes and concatenated directly into HTML output without any escaping - both within an HTML attribute context (title="...") on line 116 and in HTML content on line 119. While the 'class' attribute is properly validated using ctype_alnum(), the 'title' attribute has no sanitization whatsoever. An attacker can inject double-quote characters to break out of the title attribute and inject arbitrary HTML attributes including event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Text Toggle WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 1.1 affecting the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes. Authenticated attackers with Contributor-level privileges or above can inject arbitrary HTML attributes and event handlers by breaking out of the title attribute context, allowing malicious scripts to execute in the browsers of any user viewing affected pages. The vulnerability is classified as medium severity (CVSS 6.4) and requires authentication, but impacts site integrity and visitor security across any WordPress installation using this plugin.
Technical ContextAI
The vulnerability exists in the avp_texttoggle_part_shortcode() function within the Text Toggle plugin (cpe:2.3:a:hoosierdragon:text_toggle), where shortcode attributes are processed without proper output encoding. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of input validation and output encoding defects. Specifically, the 'title' attribute is extracted from user-supplied shortcode parameters and directly concatenated into HTML output in two contexts: as an HTML attribute value (line 116: title="...") and within HTML content (line 119), without any sanitization or escaping functions like wp_kses_post() or esc_attr(). While the 'class' attribute is protected via ctype_alnum() validation, the 'title' attribute receives no filtering, allowing double-quote injection to break attribute boundaries and inject event handlers such as onmouseover, onclick, or onerror.
RemediationAI
Upgrade the Text Toggle plugin to a patched version released after the disclosure of this vulnerability (confirm with the plugin vendor or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ac0683-120f-4e76-9d44-5ee1c789b2c8). If a patch is not yet available, disable the plugin immediately by deactivating and removing it from the WordPress plugin directory, as the vulnerability is trivial to exploit once an attacker gains Contributor access. As a temporary mitigation pending patch availability, restrict Contributor-level role assignments to only essential trusted users and audit existing contributor accounts for unauthorized creation. Additionally, implement WordPress security hardening via Web Application Firewall (WAF) rules to detect and block XSS payloads in shortcode attributes, though this is not a substitute for patching. Monitor all pages using [tt_part] or [tt] shortcodes for injected event handlers in revision history.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today