Executive brief
The TinyMCE shortcode Addon plugin for WordPress, which provides additional formatting tools for website editors, contains a security flaw. This vulnerability allows users with basic contributor-level access to embed malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'btnrel' shortcode attribute. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into a post or page using the shortcode. These scripts are stored on the server and execute in the context of any user's browser who views the affected page. The vulnerability exists in all versions up to and including 1.0.0. At the time of the advisory, the flaw is identified in the shortcode-functions.php file.
Affected products
- 360crest-themeone-tinymce-shortcodes TinyMCE shortcode Addon up to, and including, 1.0.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php
- https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2828d393-953a-4354-9032-687efda2df33?source=cve