PT-2026-26875 · Newbiesup · Wp Random Button

Zakaria · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4086

Mitre

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp random button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the random button html() function directly concatenates the 'cat' and 'nocat' parameters into HTML data-attributes without esc attr(), and the 'text' parameter into HTML content without esc html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4086

Affected Products

Wp Random Button

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4086 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0b9e11f5-5a05-4867-abd8-fb07c84a49b0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/tags/1.0/wp-random-button.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/trunk/wp-random-button.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/trunk/wp-random-button.php#L46 · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/tags/1.0/wp-random-button.php#L46 · Note