PT-2026-26859 · WordPress · Sherk Custom Post Type Displays
tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.
Youcef Hamdani
·
Published
2026-03-21
·
Updated
2026-03-31
·
CVE-2026-3554
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Sherk Custom Post Type Displays plugin for WordPress versions up to and including 1.2.1
Description
The Sherk Custom Post Type Displays plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'title' shortcode attribute. This is a result of inadequate input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. The
sherkcptdisplays func() function in includes/SherkCPTDisplaysShortcode.php extracts the 'title' attribute value from shortcode atts() on line 19 and directly incorporates it into an HTML tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.
Recommendations
Versions prior to and including 1.2.1 should be updated to a newer, fixed version if available.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sherk Custom Post Type Displays