PT-2026-26859 · WordPress · Sherk Custom Post Type Displays
Youcef Hamdani
·
Publicado
2026-03-21
·
Atualizado
2026-03-31
·
CVE-2026-3554
CVSS v3.1
6.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Sherk Custom Post Type Displays plugin for WordPress versions up to and including 1.2.1
Description
The Sherk Custom Post Type Displays plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'title' shortcode attribute. This is a result of inadequate input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. The
sherkcptdisplays func() function in includes/SherkCPTDisplaysShortcode.php extracts the 'title' attribute value from shortcode atts() on line 19 and directly incorporates it into an HTML tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.
Recommendations
Versions prior to and including 1.2.1 should be updated to a newer, fixed version if available.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sherk Custom Post Type Displays