Stored Cross-Site Scripting Vulnerability in Switch CTA Box Plugin for WordPress

CVE-2026-4088

What is CVE-2026-4088?

The Switch CTA Box plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access and above to carry out stored cross-site scripting (XSS) attacks. This is due to inadequate input sanitization and output escaping on several user-supplied post meta values such as 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. These values are read via the 'wppw_cta_box' shortcode and output directly to HTML without utilizing security functions like esc_attr(), esc_url(), or esc_html(). Consequently, attackers can inject arbitrary web scripts that execute whenever a user accesses an affected page, leading to potential security breaches.

References