CVE-2026-112111 Details
Description
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
A stored cross-site scripting vulnerability has been identified in the Bootstrap Shortcodes plugin for WordPress, affecting versions prior to 3.4.6. The issue arises in the [bs_tcontent] shortcode, where the id attribute is output into an unquoted HTML attribute. Although esc_attr() is used, it fails to properly encode space characters. This oversight allows a space in the id value to terminate the attribute, letting additional text be interpreted as separate HTML attributes, including JavaScript event handlers. As a result, authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute in the browsers of users who interact with the affected page.
Users can update to Bootstrap Shortcodes version 3.4.6 or later, which addresses the vulnerability by properly quoting the id attribute and escaping shortcode attributes. The updated version is available for download from the WordPress Plugin Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b | [email protected] | Source CodeVendor |
| https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6 | [email protected] | Release NotesVendor |
| https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84 | [email protected] | Source CodeVendor |
| https://wordpress.org/plugins/bootstrap-shortcodes/ | [email protected] | ProductVendor |
| https://wordpress.org/plugins/bootstrap-shortcodes/#developers | [email protected] | AdvisoryRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bootstrap Shortcodes | < 3.4.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |