PT-2026-20768 · Unknown · Vaakash Shortcoder

Thifx · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-27074

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions vaakash Shortcoder versions through 6.5.1

Description The software contains a flaw related to improper input handling during web page creation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be stored on the server and executed by other users when they view the affected web page. The vulnerability exists due to insufficient sanitization of user-supplied input.

Recommendations Update vaakash Shortcoder to a version later than 6.5.1.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27074

Produtos afetados

Vaakash Shortcoder

Referências · 3

• https://patchstack.com/database/Wordpress/Plugin/shortcoder/vulnerability/wordpress-shortcoder-plugin-6-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/2024411324604613059 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27074 · Nota de Segurança