CVE-2026-112111 Bootstrap Shortcodes project CVE debrief

Who should care

WordPress site administrators and defenders, especially those using the Bootstrap Shortcodes plugin, should assess exposure and apply patches to prevent potential exploitation. They should also monitor for exploitation attempts and verify patch application. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems.

Why it matters

CVE-2026-112111 is a stored XSS vulnerability in the Bootstrap Shortcodes plugin for WordPress, allowing authenticated attackers to inject arbitrary web script. Defenders should assess exposure, apply patches, and monitor for exploitation attempts.

• Potential injection of arbitrary web script in the browser of users interacting with the injected element
• Possible compromise of user sessions or sensitive data
• Required verification of patch application and vulnerability remediation
• Necessity for defenders to monitor for exploitation attempts

Technical summary

The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, allowing attackers to inject arbitrary web script. This vulnerability affects the Bootstrap Shortcodes plugin for WordPress before version 3.4.6. Authenticated attackers with Contributor-level access and above can inject arbitrary web script, which executes in the browser of any user who views the page and interacts with the injected element.

Defensive priority

Medium priority for WordPress site administrators and defenders to assess exposure and apply patches, focusing on updating the Bootstrap Shortcodes plugin to version 3.4.6 or later.

Recommended defensive actions

• Update the Bootstrap Shortcodes plugin to version 3.4.6 or later
• Assess exposure and apply patches for WordPress sites using the vulnerable plugin
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to patches and technical descriptions. The vulnerability is a stored XSS issue in the Bootstrap Shortcodes plugin for WordPress, allowing authenticated attackers to inject arbitrary web script. Defenders should verify patch application, assess exposure, and monitor for exploitation attempts. Evidence is limited, so defenders must verify the patch and assess their own exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.