EUVD-2026-24648
GHSA-f7h9-vgfr-v594
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The ER Swiffy Insert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [swiffy] shortcode in all versions up to and including 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes ('n', 'w', 'h'). These attributes are extracted using extract() and directly interpolated into the HTML output without any escaping such as esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the ER Swiffy Insert WordPress plugin through version 1.0.0 allows authenticated users with Contributor access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes that are directly interpolated into page output. The vulnerability affects all versions of the plugin and requires only contributor-level privileges to exploit, making it a persistence and privilege-escalation vector on WordPress sites with multiple user accounts.
Technical ContextAI
The ER Swiffy Insert plugin uses PHP's extract() function to unpack shortcode attributes ('n', 'w', 'h') directly into variable scope without sanitization. These extracted variables are then interpolated into HTML output via string concatenation without WordPress escaping functions such as esc_attr() or esc_html(). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS pattern where untrusted user input is rendered in a security-relevant context without encoding. The vulnerability exists in the shortcode handler, which processes user-supplied content at render time.
RemediationAI
Update the ER Swiffy Insert plugin to a patched version when available from the WordPress plugin repository, or disable and remove the plugin if no update is released. Immediate mitigation for site administrators includes restricting Contributor-level access to only trusted users, removing unnecessary Contributor accounts, and auditing existing page content for injected scripts. Implement a Web Application Firewall (WAF) rule to detect and block shortcode attributes containing script tags or event handlers. Monitor user activity logs for unexpected shortcode additions. Review the WordPress security best practices at https://wordpress.org/support/article/hardening-wordpress/. Sites should also enable WordPress plugin auto-updates if possible to receive patched versions automatically once released.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today