EUVD-2026-22868
GHSA-953c-p36c-7pc3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a <script> tag on line 29 without any JavaScript-specific escaping (e.g., wp_json_encode() or esc_js()). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Coachific Shortcode plugin for WordPress versions up to 1.0 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the 'userhash' shortcode attribute. The plugin sanitizes input with sanitize_text_field() but fails to apply JavaScript-specific escaping before interpolating the value into a script tag, enabling persistent XSS attacks visible to all page visitors. EPSS score of 6.4 reflects moderate real-world risk constrained by the requirement for authenticated contributor access and user interaction.
Technical ContextAI
The vulnerability stems from improper output encoding in WordPress plugin development. The Coachific Shortcode plugin (CPE: cpe:2.3:a:coachific:coachific_shortcode:*:*:*:*:*:*:*:*) uses sanitize_text_field() to strip HTML tags from the 'userhash' parameter on line 13, but this WordPress sanitization function does not escape JavaScript metacharacters such as quotes, semicolons, and parentheses that are significant in string contexts. The sanitized value is then directly embedded into a JavaScript string literal within a script tag on line 29 without applying JavaScript-specific escaping functions like esc_js() or wp_json_encode(). This violates the principle of context-aware output encoding; developers must apply different escaping rules depending on whether content is rendered as HTML, JavaScript, CSS, or a URL. The CWE-79 classification (Improper Neutralization of Input During Web Page Generation) correctly identifies the root cause as insufficient input validation combined with unsafe output rendering.
RemediationAI
The plugin developer must apply JavaScript-specific escaping to the 'userhash' parameter before interpolating it into the script tag. Replace the current sanitize_text_field() approach with esc_js() or wp_json_encode() followed by safe embedding in the JavaScript string context. The recommended immediate fix is to update the plugin to version 1.1 or later (once released by the developer) which applies proper output escaping. In the interim, site administrators should restrict contributor-level access to trusted users only and monitor contributor activity logs for suspicious shortcode usage. For detailed remediation guidance, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3d91158c-0b34-460e-9fdb-b99165ebca78?source=cve and review the vulnerable code references at https://plugins.trac.wordpress.org/browser/coachific-shortcode/trunk/coachific.php.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today