EUVD-2026-13999
GHSA-43fr-2m4w-5h7x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1. This is due to insufficient input sanitization and output escaping on the 'client' shortcode attribute. The ad_func() shortcode handler at line 71 accepts a 'client' attribute via shortcode_atts() and directly concatenates it into a double-quoted HTML attribute (data-ad-client) at line 130 without applying esc_attr() or any other sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Ad Short WordPress plugin versions up to 2.0.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ad' shortcode's 'client' attribute that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code into pages. The vulnerability results from insufficient input sanitization and output escaping in the ad_func() shortcode handler, which directly concatenates user-supplied input into HTML attributes without applying proper escaping functions like esc_attr(). When affected pages are visited by other users, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or malware distribution.
Technical ContextAI
The vulnerability exists in the Ad Short plugin (CPE: cpe:2.3:a:nocaredev:ad_short:*:*:*:*:*:*:*:*), which provides WordPress shortcode functionality for embedding advertisements. Specifically, the ad_func() shortcode handler at line 71 receives the 'client' attribute via the shortcode_atts() WordPress function, which parses shortcode parameters. At line 130, this unsanitized 'client' value is directly concatenated into a double-quoted HTML attribute (data-ad-client) without applying WordPress security functions. This violates CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of vulnerability where untrusted input reaches output encoding points without proper escaping. The root cause is the absence of esc_attr() or equivalent sanitization between input reception and HTML output, allowing attackers to break out of the attribute context and inject malicious script tags or event handlers.
RemediationAI
Update the Ad Short plugin to the latest patched version provided by nocaredev immediately; check the WordPress Plugin Repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/313d2749-7662-4870-b0f7-19253797f833?source=cve) for patch availability and release notes. The remediation requires applying esc_attr() to the 'client' attribute value before output at line 130 and sanitizing the input via sanitize_text_field() or similar WordPress sanitization functions during the shortcode_atts() processing. Until a patch is available, administrators should restrict Contributor-level access to only fully trusted users, audit existing posts and pages for suspicious 'ad' shortcodes, and consider using a Web Application Firewall (WAF) to block requests containing script tags or event handlers in shortcode attributes. Additionally, review WordPress user roles and capabilities to ensure only Editor and Administrator roles can publish content.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today