CVE-2026-4067
Stored XSS in Ad Short WordPress Plugin via 'client' Attribute
Publication date: 2026-03-21
Last updated on: 2026-03-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | ad_short | to 2.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
The Ad Short plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1.
This vulnerability occurs because the plugin does not properly sanitize or escape the input provided in the 'client' attribute before inserting it into the HTML output.
Specifically, the ad_func() shortcode handler accepts the 'client' attribute and directly inserts it into a double-quoted HTML attribute (data-ad-client) without using any sanitization functions like esc_attr().
As a result, authenticated users with Contributor-level access or higher can inject malicious scripts that will be stored and executed whenever any user views the affected page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Contributor-level access or higher to inject arbitrary malicious scripts into pages.
When other users visit these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.
Because the attack is stored, the malicious code persists on the site and affects all users who access the compromised content.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Ad Short plugin for WordPress to a version later than 2.0.1 where the issue is fixed.
Ensure that only trusted users have Contributor-level access or higher, as the vulnerability requires authenticated users with such privileges to exploit.
Consider temporarily disabling the Ad Short plugin if an immediate update is not possible.