PT-2026-117162

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...