Stored XSS Vulnerability in Bootstrap Shortcodes Plugin for WordPress

CVE-2026-112111

What is CVE-2026-112111?

The Bootstrap Shortcodes plugin for WordPress contains a stored XSS vulnerability that can be exploited by authenticated users with Contributor-level access or higher. The issue arises from the handling of the id attribute within the [bs_tcontent] shortcode, where the id value is inserted into an unquoted HTML attribute without proper encoding for space characters. This oversight permits attackers to inject arbitrary scripts, which may execute in the context of the user's browser when the affected element is interacted with. Users are encouraged to update to version 3.4.6 or later to mitigate this risk.

References