Bootstrap Shortcodes project CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Bootstrap Shortcodes project CVE published 2026-10-18

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before version 3.4.6 is vulnerable to stored cross-site scripting (XSS) via the id attribute of the [bs_tcontent] shortcode. Authenticated attackers with Contributor-level access and above can inject arbitrary web script, which executes in the browser of any user who views the page and interacts with the injected element.