Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-112111

Stored XSS via unquoted id attribute in Bootstrap Shortcodes [bs_tcontent]

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bootstrap Shortcodes Project Wordpress-extensions
Products
Bootstrap Shortcodes Bootstrap Shortcodes
CVE-2022-4777

Bootstrap Shortcodes <= 3.4.0 - Contributor+ Stored XSS via Shortcode

The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bootstrap Shortcodes Project
Products
Bootstrap Shortcodes