CVE-2026-4082
Stored XSS in ER Swiffy Insert WordPress Plugin via Shortcode
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | er_swiffy_insert | to 1.0.0 (inc) |
| swiffy_insert | swiffy_insert | to 1.0.0 (inc) |
| er_swiffy_insert | plugin | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access or above to inject arbitrary malicious scripts into pages. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. This compromises the integrity and security of the website and its users.
Can you explain this vulnerability to me?
The ER Swiffy Insert plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.0.0. This vulnerability arises because the plugin does not properly sanitize or escape user-supplied shortcode attributes ('n', 'w', 'h'). These attributes are extracted and directly inserted into the HTML output without escaping, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts then execute whenever any user views the affected page.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via stored cross-site scripting (XSS). This can lead to unauthorized access to user data or session hijacking.
Such unauthorized access or data exposure caused by XSS vulnerabilities can potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or disclosure.
However, the provided information does not explicitly detail the direct impact on compliance with these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored Cross-Site Scripting (XSS) via the [swiffy] shortcode in the ER Swiffy Insert WordPress plugin. Detection involves identifying pages or posts containing the vulnerable shortcode with malicious script injections in the shortcode attributes ('n', 'w', 'h').
You can search your WordPress database for instances of the [swiffy] shortcode containing suspicious script tags or unusual attribute values.
- Use a SQL query on the WordPress database to find posts with the shortcode, for example: SELECT ID, post_content FROM wp_posts WHERE post_content LIKE '%[swiffy%';
- Manually inspect or use grep to search exported content files for script tags or suspicious payloads within the shortcode attributes.
- Monitor HTTP responses for injected scripts by capturing traffic with tools like Burp Suite or OWASP ZAP when accessing pages that use the shortcode.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the ER Swiffy Insert plugin to a version that fixes the input sanitization and output escaping issues, if such an update is available.
If no update is available, temporarily disable or remove the plugin to prevent exploitation.
Restrict Contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated access at Contributor level or above.
Review and sanitize existing content containing the [swiffy] shortcode to remove any injected scripts.