PT-2026-47636 · WordPress · Tinymce Shortcode Addon

Zakaria · CVE-2026-10024 · Published 2026-06-09 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE shortcode Addon plugin for WordPress versions prior to 1.0.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the btnrel shortcode attribute, which execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.0.0. As a temporary mitigation, restrict the use of the btnrel attribute in shortcodes for users with contributor-level access.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-10024

Affected Products

Tinymce Shortcode Addon

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-10024 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2828d393-953a-4354-9032-687efda2df33?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1u9fi90/critical_alert_unpatched_vulnerabilities_found · Reddit Post
• https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php#L50 · Note
• https://twitter.com/atomicedgeWAF/status/2064627510713651361 · Twitter Post
• https://plugins.trac.wordpress.org/browser/360crest-themeone-tinymce-shortcodes/trunk/includes/shortcode-functions.php#L59 · Note
• https://t.me/cveNotify/166642 · Telegram Post