CVE-2026-9677

The Shariff for WordPress plugin (versions prior to 1.0.12 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize or escape the shariff_infourl setting before it is output in the frontend HTML via the generateshariff() function. This allows high-pri...