Description

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T08:16:25.253Z",
  "pubdate": "2026-07-23T08:16:25.253Z",
  "executiveSummary": "The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This security flaw enables authenticated attackers with contributor-level access and above to inject arbitrary web scripts into vulnerable pages.\nThe vulnerability arises due to insufficient input sanitization and output escaping implemented within the plugin codebase. When an affected page containing the crafted shortcode is rendered, the injected malicious script executes within the context of the victim's browser session. This can lead to unauthorized actions, session hijacking, or the manipulation of content displayed to users accessing the compromised page.\nThe risk implication is moderate to high depending on the privileges of the targeted victims who view the injected content, particularly if administrative users access the compromised resources. Exploitation requires authenticated access with at least contributor-level privileges to create or modify posts and pages containing the malicious shortcode payload.",
  "technicalDetails": "The vulnerability exists in the mts_tabs() function of the WP Shortcode by MyThemeShop plugin, which handles the processing and rendering of the [tab] shortcode. The root cause of the issue is the direct concatenation and output of the title shortcode attribute directly into the HTML output stream between anchor tags without applying any contextual input sanitization or output escaping functions.\nAffected versions include all iterations of the WP Shortcode by MyThemeShop plugin up to, and including, 1.4.17. The vulnerable component is specifically the shortcode parsing logic located within the plugin's internal functions responsible for generating tabbed interface elements.\nExploitation of this Stored Cross-Site Scripting vulnerability requires network exposure via the WordPress application interface, alongside authenticated access with contributor-level privileges or higher. An attacker leverages these privileges to author or edit a post, page, or custom post type, embedding a malicious payload within the title parameter of the [tab] shortcode, such as [tab title=\"<script>alert(1)</script>\">Content</tab>.\nUpon saving the post or page, the malicious payload is stored persistently within the WordPress database. When any user or administrator subsequently requests the affected page, the server processes the shortcode via the vulnerable mts_tabs() function and renders the unescaped title attribute directly into the Document Object Model (DOM).\nThe payload behavior involves the execution of arbitrary JavaScript within the browser of the viewing user. Depending on the constructed payload and the privileges of the victim, post-exploitation impact can include session hijacking via cookie theft, unauthorized administrative actions performed on behalf of the victim, or defacement of the rendered web application interface."
}