EUVD-2026-39947
GHSA-vm7c-g967-fj52
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H reflects mandatory admin authentication to set the payload; UI:R requires victim page load; S:C captures cross-user browser script execution; no availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
2DescriptionCVE.org
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
AnalysisAI
Stored Cross-Site Scripting in Shariff for WordPress (≤1.0.11) allows high-privilege users such as administrators to inject malicious JavaScript through the unsanitized shariff_infourl plugin setting, which is rendered verbatim in frontend HTML by the generateshariff() function. The vulnerability is especially significant in WordPress multisite environments where the unfiltered_html capability is deliberately restricted, as this plugin bypasses that security control. No confirmed active exploitation (not in CISA KEV); SSVC indicates a POC exists, but EPSS at 0.15% (5th percentile) reflects very low observed exploitation probability.
Technical ContextAI
The Shariff for WordPress plugin implements social share buttons via its generateshariff() PHP function, which constructs frontend HTML using stored plugin settings. The shariff_infourl setting - intended to hold an informational URL - is output directly into the rendered HTML without sanitization or output escaping, constituting a Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) flaw. The CVSS S:C (Scope Changed) metric confirms that the injected payload executes outside the plugin's security scope, in the browser contexts of visiting users. WordPress multisite deployments are disproportionately affected because unfiltered_html is routinely disabled for non-super-admins in that configuration, making this bypass a meaningful security boundary violation. No CPE string was provided in the available intelligence data; affected versions are identified as Shariff for WordPress 0 through 1.0.11 inclusive per EUVD-2026-39947.
RemediationAI
The primary remediation is to update the Shariff for WordPress plugin to a version beyond 1.0.11; however, no exact patched release version was confirmed in the available intelligence data - administrators should check the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/c40298d0-42c2-406c-817a-9bbf246bbeea/ for a confirmed fixed version before upgrading. If no patched version is yet available, the most effective compensating control is to clear the shariff_infourl setting and leave it empty, which prevents the malicious output from being rendered. In multisite environments, restricting plugin settings modification to only fully trusted super-admins reduces exposure, though this does not eliminate the vulnerability. Deactivating the Shariff plugin entirely is an option in high-sensitivity multisite setups where untrusted administrators exist; the trade-off is loss of social sharing functionality. Monitoring WordPress admin audit logs for unexpected changes to plugin settings can serve as a detection control.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today