Wp Shortcode By Mythemeshop
Monthly
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.