Stored Cross-Site Scripting Vulnerability in ER Swiffy Insert Plugin for WordPress

CVE-2026-4082

What is CVE-2026-4082?

The ER Swiffy Insert plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) through its [swiffy] shortcode. This issue arises from inadequate sanitization of user-provided attributes ('n', 'w', 'h') which are directly embedded into the HTML output without proper escaping mechanisms. As a result, authenticated users with Contributor-level access and higher can potentially inject malicious scripts that execute when other users access affected pages, leading to significant security risks.

References