CVE-2026-4279
Stored XSS in Bread & Butter WordPress Plugin Button Shortcode
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bread_and_butter | plugin | to 8.2.0.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in the Bread & Butter WordPress plugin versions up to and including 8.2.0.25 due to insufficient input sanitization on the 'breadbutter-customevent-button' shortcode. Immediate mitigation steps include updating the plugin to a version later than 8.2.0.25 where this issue is fixed.
Additionally, restrict Contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated users with at least Contributor access to exploit.
Can you explain this vulnerability to me?
The Bread & Butter plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'breadbutter-customevent-button' shortcode in all versions up to and including 8.2.0.25.
This vulnerability arises because the 'event' attribute of the shortcode is not properly sanitized or escaped before being inserted into a JavaScript string within an onclick HTML attribute.
Specifically, the function customEventShortCodeButton() interpolates the 'event' attribute directly without using proper escaping functions like esc_attr() or esc_js(), allowing attackers to inject arbitrary scripts.
Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when any user clicks the injected button on a page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Contributor-level access or above to inject malicious JavaScript code into pages via the vulnerable shortcode.
When other users visit these pages and click the injected button, the malicious scripts execute, potentially leading to theft of user credentials, session hijacking, or unauthorized actions performed on behalf of the user.
Because the attack requires authenticated access, it can be used to escalate privileges or compromise site integrity from within the user base.