CVE-2026-112111: XSS

Q: Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it by supplying a crafted id value to the [bs_tcontent] shortcode. Exploitation also requires a victim to view the affected page and interact with the injected element.

Q: Which plugin versions are affected?

Bootstrap Shortcodes versions before 3.4.6 are affected. Version 3.4.6 is identified as the release containing the fix.

Q: What is the practical impact of successful exploitation?

A contributor or higher-privileged user can inject arbitrary JavaScript into a page through stored content. The script executes in the browser of users who view the page and interact with the malicious element.

Q: How can I identify potentially affected content?

Review content created by Contributor-level or higher users for [bs_tcontent] shortcodes with id attribute values containing spaces or unexpected text after a space. Such input can cause additional HTML attributes, including JavaScript event handlers, to be parsed.

Published Oct 18, 2026

Updated

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bstcontent] shortcode. The bstcontent() shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

Affected Software

1 affected component

WordPress Bootstrap Shortcodes<3.4.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bootstrap Shortcodes to a version that resolves this vulnerability.
Fixed in 3.4.6

Event History

Oct 18, 2026

CVE Published

via MITRE·10:39 PM

Data Sourced

via MITRE·10:39 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it by supplying a crafted id value to the [bs_tcontent] shortcode. Exploitation also requires a victim to view the affected page and interact with the injected element.

Which plugin versions are affected?

Bootstrap Shortcodes versions before 3.4.6 are affected. Version 3.4.6 is identified as the release containing the fix.

What is the practical impact of successful exploitation?

A contributor or higher-privileged user can inject arbitrary JavaScript into a page through stored content. The script executes in the browser of users who view the page and interact with the malicious element.

How can I identify potentially affected content?

Review content created by Contributor-level or higher users for [bs_tcontent] shortcodes with id attribute values containing spaces or unexpected text after a space. Such input can cause additional HTML attributes, including JavaScript event handlers, to be parsed.

CVE-2026-112111: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the practical impact of successful exploitation?

How can I identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the practical impact of successful exploitation?

How can I identify potentially affected content?