EUVD-2026-24652
GHSA-6jwx-v327-2xh9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. The shortcode reads post meta from a user-specified post ID and echoes these values directly into HTML output without any escaping functions (no esc_attr(), esc_url(), or esc_html()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Switch CTA Box WordPress plugin up to version 1.1 allows authenticated contributors and above to inject arbitrary JavaScript through unsanitized post meta fields including button link, button ID, button text, and description. The vulnerability arises from direct output of user-supplied data into HTML without escaping functions, enabling attackers to execute malicious scripts whenever pages containing injected shortcodes are accessed by any visitor.
Technical ContextAI
The vulnerability exists in the WordPress plugin's shortcode handler, which retrieves post metadata fields (cta_box_button_link, cta_box_button_id, cta_box_button_text, cta_box_description) via the 'wppw_cta_box' shortcode and renders them directly into HTML output in box_display_template.php and shortcode_setup.php without invoking WordPress security functions such as esc_attr(), esc_url(), or esc_html(). This is a classic Stored XSS vulnerability (CWE-79) where malicious input persists in the WordPress post meta database and executes in the browser context of all page visitors, not just the injector. The attack surface is limited to authenticated users with contributor-level permissions or higher, who can modify post metadata or create posts using the vulnerable shortcode.
RemediationAI
Update Switch CTA Box plugin to version 1.2 or later (version number inferred from typical WordPress plugin versioning; verify current stable release on plugins.wordpress.org). The patch should include proper input sanitization via sanitize_text_field() or sanitize_url() for post meta on save, and output escaping via esc_attr(), esc_url(), and esc_html() in box_display_template.php and shortcode_setup.php before echoing meta values. If an immediate patch is unavailable, restrict contributor role access via role/capability plugins or disable the 'wppw_cta_box' shortcode entirely using remove_shortcode( 'wppw_cta_box' ) in functions.php as a temporary measure, accepting loss of plugin functionality. Monitor for plugin updates at https://plugins.wordpress.org/plugins/switch-cta-box/ and review code commits on https://plugins.trac.wordpress.org/browser/switch-cta-box/.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today