PT-2026-26724 · WordPress · Scoreboard For Html5 Games Lite

Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-4083

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Scoreboard for HTML5 Games Lite plugin for WordPress versions up to and including 1.2

Description The Scoreboard for HTML5 Games Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'scoreboard' shortcode. The sfhg shortcode() function permits the addition of arbitrary HTML attributes to the rendered <iframe> element, with a limited blacklist of four attribute names (same height as, onload, onpageshow, onclick). While attribute names are processed by esc html() and values by esc attr(), this does not prevent the injection of JavaScript event handler attributes such as onfocus, onmouseover, and onmouseenter, as these attributes and simple JavaScript payloads do not contain characters modified by these escaping functions. The shortcode text is stored in post content and rendered to HTML after WordPress’s kses filtering, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the injected page.

Recommendations Versions prior to 1.3 are vulnerable. Update to a version greater than 1.2 to address this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4083

Affected Products

Scoreboard For Html5 Games Lite

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-4083 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/550ae348-254e-49f5-8046-38629c774802?source=cve · Note
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/trunk/scoreboard-for-html5-game-lite.php#L274 · Note
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/tags/1.2/scoreboard-for-html5-game-lite.php#L320 · Note
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/trunk/scoreboard-for-html5-game-lite.php#L317 · Note
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/trunk/scoreboard-for-html5-game-lite.php#L320 · Note
• https://twitter.com/CVEnew/status/2035262101535539475 · Twitter Post
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/tags/1.2/scoreboard-for-html5-game-lite.php#L317 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3483176%40scoreboard-for-html5-game-lite&new=3483176%40scoreboard-for-html5-game-lite&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/scoreboard-for-html5-game-lite/tags/1.2/scoreboard-for-html5-game-lite.php#L274 · Note