CVE-2026-9677
Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
| Vendor | unknown |
| Product | shariff for wordpress |
| Published | Jun 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown shariff for wordpress
Be the first to know when new unknown vulnerabilities affecting unknown shariff for wordpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Shariff for WordPress
0 ≤ 1.0.11
References
Credits
Mustafa Ahmed WPScan