PatchSiren cyber security CVE debrief

CVE-2026-10024 360crest CVE debrief

The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor: 360crest
Product: TinyMCE shortcode Addon
CVSS: MEDIUM 6.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-09
Original CVE updated: 2026-06-09
Advisory published: 2026-06-09
Advisory updated: 2026-06-09

Who should care

Users of TinyMCE shortcode Addon plugin for WordPress, version 1.0.0 or earlier, should update to the latest version to prevent Stored Cross-Site Scripting attacks.

Technical summary

The vulnerability exists in the TinyMCE shortcode Addon plugin for WordPress, specifically in the 'btnrel' Shortcode Attribute. The plugin does not properly sanitize input and escape output, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts.

Defensive priority

MEDIUM

Recommended defensive actions

Update to the latest version of TinyMCE shortcode Addon plugin for WordPress.
Restrict access to the plugin's functionality to prevent unauthorized users from injecting malicious scripts.

Evidence notes

The CVE-2026-10024 record and NVD detail provide information on the vulnerability, including its CVSS score and vector.

Sources and references

Verified primary and authoritative sources

CVE-2026-10024 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-10024

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-10024 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10024

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.