Executive brief
The Credits Shortcode plugin for WordPress, which allows site owners to easily display attribution or credit links, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into website pages. When other users or administrators visit these pages, the scripts will execute, potentially leading to unauthorized actions or data theft.
Technical details
The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'link' attribute within the 'credits' shortcode. This vulnerability exists in all versions up to and including 1.2. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into a post or page. Because the script is stored on the server, it will execute in the browser of any user who views the affected page. This can lead to session hijacking or unauthorized administrative actions if a high-privileged user views the content.
Affected products
- WordPress Credits Shortcode Up to, and including, 1.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory