CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
| CWE | CWE-79 |
| Vendor | bootstrap shortcodes project |
| Product | bootstrap shortcodes |
| Published | Oct 18, 2026 |
| Last Updated | Oct 18, 2026 |
Get instant alerts for bootstrap shortcodes project bootstrap shortcodes
Be the first to know when new unknown vulnerabilities affecting bootstrap shortcodes project bootstrap shortcodes are published — delivered to Slack, Telegram or Discord.