Stored Cross-Site Scripting Vulnerability in Bread & Butter Plugin for WordPress

CVE-2026-4279

What is CVE-2026-4279?

The Bread & Butter plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability caused by inadequate input sanitization and output escaping on the 'event' shortcode attribute. The 'breadbutter-customevent-button' shortcode allows authenticated users with Contributor-level access to inject malicious JavaScript into pages. When users click on the affected button, potentially harmful scripts can execute, compromising user data and security. The issue arises because the customEventShortCodeButton() function directly interpolates the problematic attribute into an onclick HTML attribute without using necessary escape functions. Proper security measures, such as input validation and output sanitization, are critical to prevent such attacks.

References