6 matches found
EUVD-2026-104011
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress (versions before 3.4.6 ) is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The root cause is located in the bs_tcontent() handler within inc/bs_tabs.php, which emits the id attribute into an unquoted HTML attribute. Whil...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111: Improper Neutralization of Input During Web Page Generation
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...