{"id":"CVE-2026-112111","kind":"vulnerability","aliases":["CVE-2026-112111"],"related":[],"title":"WordPress Bootstrap Shortcodes plugin: stored XSS via bs_tcontent id attribute","description":"The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.","summary":"The Bootstrap Shortcodes plugin for WordPress before 3.4.6 emits the id attribute of the [bs_tcontent] shortcode into an unquoted HTML attribute, so a space in the value breaks out of it. A contributor-level user can inject JavaScript event handlers that run in the browser of any visitor who interacts with the injected element.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-bs-tcontent-shortcode-use","plugin-at-3.4.6-or-later"],"how_to_check":"- Check whether the Bootstrap Shortcodes plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list`\n- Search posts for the `[bs_tcontent` shortcode with an id value containing a space","fix":"- Update the Bootstrap Shortcodes plugin to `3.4.6` or later\n- Review existing posts with `[bs_tcontent` shortcodes for unexpected id values containing spaces or event handler attributes","status":"open","published_at":"2026-10-18T23:16:56+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:29:11+00:00","updated_at":"2026-10-25T04:29:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:29:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Bootstrap Shortcodes plugin to `3.4.6` or later\n- Review existing posts with `[bs_tcontent` shortcodes for unexpected id values containing spaces or event handler attributes","reach":"internet","title":"WordPress Bootstrap Shortcodes plugin: stored XSS via bs_tcontent id attribute","impact":"medium","summary":"The Bootstrap Shortcodes plugin for WordPress before 3.4.6 emits the id attribute of the [bs_tcontent] shortcode into an unquoted HTML attribute, so a space in the value breaks out of it. A contributor-level user can inject JavaScript event handlers that run in the browser of any visitor who interacts with the injected element.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs JavaScript in visitors' browsers, stealing sessions or actions","analyst_note":"","how_to_check":"- Check whether the Bootstrap Shortcodes plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list`\n- Search posts for the `[bs_tcontent` shortcode with an id value containing a space","needs_analyst":false,"not_affected_if":["plugin-at-3.4.6-or-later","no-bs-tcontent-shortcode-use"],"who_is_affected":"Sites running the Bootstrap Shortcodes WordPress plugin before 3.4.6 that let contributor-level or higher users create or edit content using the bs_tcontent shortcode. Sites without this plugin, or with it at 3.4.6 or later, are not affected. Sites where only administrators or editors write content have a lower risk but should still update.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3460,"output_tokens":663,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112111':14A,17A '-2026':13A,16A '3.4.6':33B,89C 'access':164C 'addit':149C 'allow':157C 'appli':124C 'arbitrari':169C 'attack':159C 'attr':122C 'attribut':11A,37B,47B,98C,114C,120C,141C,151C 'authent':158C 'bootstrap':2A,27B,83C 'break':54B 'browser':72B,176C 'bs':8A,40B,101C,105C 'charact':131C 'contributor':60B,162C 'contributor-level':59B,161C 'cve':12A,15A 'element':81B,189C 'emit':34B,111C 'encod':129C 'esc':121C 'event':66B,154C 'execut':173C 'follow':144C 'handler':67B,108C,155C 'host':21B 'html':46B,119C,150C 'id':10A,36B,97C,113C 'inc/bs_tabs.php':110C 'includ':152C 'inject':64B,80B,168C,188C 'interact':77B,185C 'javascript':65B,153C 'level':61B,163C 'packag':18B 'page':183C 'pars':147C 'plugin':4A,25B,29B,85C 'run':69B 'script':171C 'self':20B 'self-host':19B 'shortcod':3A,28B,42B,84C,103C,107C 'space':50B,130C,134C 'store':5A,93C 'suppli':137C 'tcontent':9A,41B,102C,106C 'termin':139C 'text':145C 'unquot':45B,118C 'user':62B,179C 'valu':53B,115C,138C 'via':7A,95C 'view':181C 'visitor':75B 'vulner':91C 'web':170C 'wordpress':1A,22B,24B,31B,87C 'wordpress-plugin':23B 'xss':6A,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bootstrap Shortcodes WordPress plugin before 3.4.6 that let contributor-level or higher users create or edit content using the bs_tcontent shortcode. Sites without this plugin, or with it at 3.4.6 or later, are not affected. Sites where only administrators or editors write content have a lower risk but should still update.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T23:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112111","severity":null,"published_at":"2026-10-18T23:16:56+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}