EUVD-2026-24686
GHSA-g8vq-gpv7-9mmq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Bread & Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'breadbutter-customevent-button' shortcode in all versions up to, and including, 8.2.0.25. This is due to insufficient input sanitization and output escaping on the 'event' shortcode attribute. The customEventShortCodeButton() function takes the 'event' attribute value and directly interpolates it into a JavaScript string within an onclick HTML attribute without applying esc_attr() or esc_js(). Notably, the sister function customEventShortCode() properly uses esc_js() for the same attribute, but this was omitted in the button variant. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page and clicks the injected button.
AnalysisAI
Stored cross-site scripting in Bread & Butter plugin for WordPress up to version 8.2.0.25 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'event' attribute of the 'breadbutter-customevent-button' shortcode. The vulnerability arises from missing output escaping in the customEventShortCodeButton() function, which directly interpolates unsanitized user input into an onclick HTML attribute. Scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malicious content injection.
Technical ContextAI
The Bread & Butter plugin implements shortcode functionality for WordPress via the customEventShortCodeButton() and customEventShortCode() functions in src/Base/Shortcode.php. Both functions accept an 'event' attribute intended to specify JavaScript event handlers. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from the button variant failing to apply WordPress escaping functions when constructing the onclick attribute, whereas the sister function correctly uses esc_js(). The vulnerability affects the shortcode parser's attribute interpolation, which occurs server-side during page rendering but executes client-side JavaScript in user browsers. CPE data indicates the vulnerable product is 'breadbutter:bread_&_butter:_ai-powered_lead_intelligence' across all versions up to 8.2.0.25.
RemediationAI
Update Bread & Butter plugin to a version newer than 8.2.0.25 as soon as available (exact patched version not confirmed in provided data-check WordPress plugin repository for latest release). The fix requires the plugin developers to apply esc_js() or esc_attr() escaping to the 'event' attribute in customEventShortCodeButton(), mirroring the correct implementation in customEventShortCode(). In the interim, WordPress administrators can mitigate risk by restricting Contributor-level role assignment to trusted users only; audit existing Contributor accounts and demote unnecessary ones. Additionally, remove or replace any existing 'breadbutter-customevent-button' shortcodes from published pages and posts until patched, as malicious instances may persist in page revision history. Site administrators using plugins like Wordfence can enable Web Application Firewall rules to block inline onclick event injection patterns. These compensating controls reduce but do not eliminate risk, as determined attackers with Contributor access can still craft payloads. Upgrading to the patched version remains the definitive fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today