Live › vulnerability › CVE-2026-112111
Go to dashboardThe Bootstrap Shortcodes plugin for WordPress before 3.4.6 emits the id attribute of the [bs_tcontent] shortcode into an unquoted HTML attribute, so a space in the value breaks out of it. A contributor-level user can inject JavaScript event handlers that run in the browser of any visitor who interacts with the injected element.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Bootstrap Shortcodes WordPress plugin before 3.4.6 that let contributor-level or higher users create or edit content using the bs_tcontent shortcode. Sites without this plugin, or with it at 3.4.6 or later, are not affected. Sites where only administrators or editors write content have a lower risk but should still update.
No product ranges from the sources yet.
wp plugin list[bs_tcontent shortcode with an id value containing a space3.4.6 or later[bs_tcontent shortcodes for unexpected id values containing spaces or event handler attributesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
This page as .md · .json · in your agent: get_signal("CVE-2026-112111")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.