Executive brief
The Github Shortcode plugin for WordPress, which allows users to easily display GitHub repository information on their websites, contains a security flaw. This vulnerability allows users with basic contributor-level access to embed malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'repo' attribute within the 'github' shortcode. This vulnerability exists in all versions up to and including 0.1. An authenticated attacker with Contributor-level permissions or higher can exploit this by injecting malicious JavaScript into a post or page via the shortcode. Because the script is stored on the server, it will execute in the browser context of any user who views the compromised page. The attack vector is network-based and requires low-level authentication, but no further user interaction beyond viewing the page.
Affected products
- Github Shortcode plugin for WordPress Github Shortcode Up to, and including, 0.1
Timeline
- 2026-05-27: disclosed: Initial publication of the vulnerability advisory.
- 2026-05-27: advisory: NVD and Wordfence published detailed advisory information.