EUVD-2026-14010
GHSA-x5f6-m38m-6rp5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the random_button_html() function directly concatenates the 'cat' and 'nocat' parameters into HTML data-attributes without esc_attr(), and the 'text' parameter into HTML content without esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The WP Random Button WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.0 affecting all installations of this plugin. Authenticated attackers with Contributor-level or higher privileges can inject arbitrary JavaScript code through improperly sanitized shortcode attributes ('cat', 'nocat', and 'text'), which will execute in the browsers of any user viewing the affected pages. With a CVSS score of 6.4 and network-accessible attack vector requiring only low-privileged authenticated access, this vulnerability poses a moderate but realistic risk to WordPress sites using this plugin, particularly those with contributor-level user accounts or where user roles are not carefully managed.
Technical ContextAI
The vulnerability stems from insufficient input sanitization and output escaping in the random_button_html() function of the WP Random Button plugin (CPE: cpe:2.3:a:newbiesup:wp_random_button:*:*:*:*:*:*:*:*). The plugin processes WordPress shortcode attributes ('cat', 'nocat', and 'text') and directly concatenates them into HTML without using WordPress security functions. Specifically, the 'cat' and 'nocat' parameters are inserted into HTML data-attributes without the esc_attr() function, while the 'text' parameter is concatenated into HTML content without esc_html() escaping. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input flows directly into the output context without proper encoding for that context. The vulnerability is particularly severe because shortcodes are stored content—once injected via the post/page editor, the malicious script persists in the database and executes for all subsequent page views, making this a Stored XSS rather than Reflected XSS.
RemediationAI
The primary remediation is to update the WP Random Button plugin to a patched version beyond 1.0 if and when such a patch is released by the plugin maintainer (newbiesup); site administrators should monitor the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e11f5-5a05-4867-abd8-fb07c84a49b0) for patch availability. Until a patch is available, disable or remove the WP Random Button plugin entirely if it is not critical to site functionality. As an interim preventive control, restrict Contributor-level and above role assignments to trusted administrators only, and audit existing posts and pages using the wp_random_button shortcode for any suspicious attribute values that may have already been injected. Additionally, implement WordPress security hardening measures such as Web Application Firewall (WAF) rules to block requests containing common XSS payloads in shortcode attributes, and enable Content Security Policy (CSP) headers to mitigate the impact if XSS injection occurs despite preventive measures.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today