CVE-2026-4005
|
| |
|
|
Affected software |
WORDPRESS |
|
|
|
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-4005 |
