CVE-2026-112111

Received Received - Intake

Stored XSS in Bootstrap Shortcodes WordPress Plugin

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: MITRE

Description

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112111

EUVD

EUVD-2026-104011

Affected Vendors & Products

Vendor	Product	Version / Range
Bootstrap	Shortcodes	project Bootstrap Shortcodes 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Bootstrap Shortcodes plugin for WordPress before version 3.4.6 has a stored cross-site scripting (XSS) vulnerability. This occurs in the [bs_tcontent] shortcode due to improper handling of the id attribute. The plugin uses esc_attr() to sanitize the attribute value, but this function does not encode spaces. As a result, a space in the id value can prematurely terminate the HTML attribute, allowing attackers to inject additional malicious HTML attributes, such as JavaScript event handlers. This vulnerability requires authenticated attackers with Contributor-level access or higher to exploit.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Bootstrap Shortcodes plugin versions before 3.4.6. Check for the [bs_tcontent] shortcode with an id attribute containing spaces or special characters that could lead to XSS. Manually review plugin files like inc/bs_tabs.php for improper escaping of the id attribute.

Impact Analysis

If exploited, this vulnerability allows attackers to inject malicious scripts into web pages viewed by users. When a user interacts with the injected element, the script executes in their browser, potentially stealing session cookies, redirecting to phishing sites, or performing actions on behalf of the user. Users with Contributor-level access or higher in WordPress can exploit this to compromise visitors' browsers.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, triggering legal penalties, loss of trust, and compliance fines under these regulations.

Mitigation Strategies

Immediately update the Bootstrap Shortcodes plugin to version 3.4.6 or later. If updating is not possible, disable or remove the plugin entirely. Review user roles with Contributor access or higher to ensure no unauthorized content is published. Monitor for suspicious activity or injected scripts in web pages.

Hi! I’m here to help you understand CVE-2026-112111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70