PT-2026-26870 · WordPress · Ad Short

Zakaria · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4067

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ad Short versions prior to 2.0.2

Description The Ad Short plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'client' attribute of the 'ad' shortcode. Insufficient input sanitization and output escaping on the 'client' shortcode attribute allows for the injection of arbitrary web scripts. The ad func() shortcode handler, specifically at line 71, uses shortcode atts() to accept the 'client' attribute and directly incorporates it into a double-quoted HTML attribute (data-ad-client) at line 130 without proper sanitization using esc attr() or similar methods. This enables authenticated attackers with Contributor-level access or higher to inject malicious scripts into pages, which will then execute when a user accesses those pages.

Recommendations Update the Ad Short plugin to version 2.0.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4067

Affected Products

Ad Short

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4067 · Security Note
• https://plugins.trac.wordpress.org/browser/ad-short/trunk/ad_short.php#L130 · Note
• https://twitter.com/CVEnew/status/2035237297617346994 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035256233435807998 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ad-short/tags/2.0.1/ad_short.php#L77 · Note
• https://plugins.trac.wordpress.org/browser/ad-short/tags/2.0.1/ad_short.php#L130 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/313d2749-7662-4870-b0f7-19253797f833?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ad-short/trunk/ad_short.php#L77 · Note