EUVD-2026-47935
GHSA-q9pq-xp5c-jmhr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor-level auth (PR:L) gates payload injection; stored XSS fires on normal page load without additional victim action (UI:N); scope change (S:C) reflects execution crossing into victim browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Generation - Cross-Site Scripting), specifically the stored/persistent variant. The root cause is in the mts_tabs() function within wp-shortcode.php, where the WordPress shortcode API passes the 'title' attribute of the [tab] shortcode directly into the rendered HTML output between anchor tags without applying any standard WordPress output-escaping functions such as esc_attr() or esc_html(). This is confirmed by source code references at plugin trunk lines 766 and 774. Because the unescaped payload is stored in the WordPress post database, it persists and executes for every subsequent page visitor without further attacker interaction. The affected surface is identified by CPE cpe:2.3:a:mythemeshop:wp_shortcode_by_mythemeshop:*:*:*:*:*:*:*:*, covering all plugin versions through 1.4.17.
RemediationAI
No specific patched version number is confirmed in the available data; site operators should consult the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6f3bcf70-2900-4a13-9ed4-264a15af9725 for any release beyond 1.4.17 that addresses this issue. If no updated version is yet available, the most effective compensating control is to deactivate the WP Shortcode by MyThemeShop plugin entirely, which eliminates the attack surface at the cost of losing all shortcode functionality provided by the plugin. If deactivation is operationally infeasible, restrict contributor-level WordPress roles using a role-management plugin to prevent untrusted users from publishing or editing content that can embed the [tab] shortcode. A WAF rule targeting XSS patterns in the [tab] shortcode title parameter can reduce risk, but should not be relied upon as the sole control given the breadth of known XSS bypass techniques.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today