PT-2026-26875 · WordPress · Wp Random Button

Zakaria · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4086

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Random Button plugin for WordPress versions prior to 1.0.

Description The WP Random Button plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp random button' shortcode. This is a result of inadequate input sanitization and output escaping of user-provided shortcode attributes. The random button html() function directly combines the 'cat' and 'nocat' parameters into HTML data-attributes without proper escaping, and the 'text' parameter into HTML content without escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages, which will then execute when a user accesses the affected page.

Recommendations Update the WP Random Button plugin to a version later than 1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4086

Affected Products

Wp Random Button

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4086 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/tags/1.0/wp-random-button.php#L50 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0b9e11f5-5a05-4867-abd8-fb07c84a49b0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/trunk/wp-random-button.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/trunk/wp-random-button.php#L46 · Note
• https://plugins.trac.wordpress.org/browser/wp-random-button/tags/1.0/wp-random-button.php#L46 · Note
• https://twitter.com/CVEnew/status/2035237311945089098 · Twitter Post