CVE-2026-0737: 
WordPress vulnerability analysis and mitigation

CVE-2026-0737 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress. It affects all versions up to and including 7.4.7, and was disclosed on April 4, 2026. The flaw exists in the src attribute of the su_lightbox shortcode due to insufficient input sanitization and output escaping. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization of the src attribute within the su_lightbox shortcode handler, allowing arbitrary JavaScript to be stored in page content. An authenticated attacker with at least contributor-level access can craft a malicious shortcode containing injected script payloads; these are then rendered unsanitized in the browser of any user who visits the affected page. The fix was applied in version 7.4.8, as visible in the patched lightbox.php source (GitHub Advisory, CleanTalk Research).

Successful exploitation allows authenticated contributors to persistently inject malicious scripts into WordPress pages, which execute in the browsers of all subsequent visitors without any additional user interaction. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and potential website defacement. Because the injected scripts execute in the context of the affected site, the scope extends beyond the attacker's own session to all site users, including administrators (Wordfence, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running WP Shortcodes Plugin — Shortcodes Ultimate version 7.4.7 or earlier, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a su_lightbox shortcode with a malicious src attribute, e.g., [su_lightbox src="javascript:alert(document.cookie)"]Click[/su_lightbox] or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
4. Publish or submit content: Submit the post for review or publish it directly (depending on role permissions), embedding the stored XSS payload in the site's database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further exploitation (CleanTalk Research, GitHub Advisory).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing su_lightbox shortcode with unusual src values; audit log entries for page/post edits by low-privilege users.
• File System: No direct file-system artifacts expected for this stored XSS; however, unexpected modifications to post content in the WordPress database (wp_posts table) containing su_lightbox shortcodes with JavaScript URIs or external script references.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting affected pages (indicative of cookie/session exfiltration); unusual JavaScript resource loads originating from pages containing su_lightbox shortcodes.
• Process/Behavior: Admin accounts performing unexpected actions (password changes, plugin installs, user creation) that may indicate session hijacking following XSS exploitation (Wordfence).

Update the WP Shortcodes Plugin — Shortcodes Ultimate to version 7.4.8 or later, which includes the fix for improper output escaping in lightbox.php (GitHub Advisory). If an immediate update is not possible, restrict contributor-level and above account access to only fully trusted users, and audit existing contributor accounts for suspicious shortcode usage. Consider temporarily disabling the su_lightbox shortcode functionality or the plugin itself until patching is feasible. Regularly review page and post content for unexpected su_lightbox shortcodes with unusual src values (Wordfence).

Wordfence disclosed the vulnerability through their threat intelligence platform and assigned the CVE, noting it as a moderate-severity stored XSS issue. Sucuri included it in their April 2026 vulnerability patch roundup, highlighting it among notable WordPress plugin issues for the month (Sucuri Blog). No significant social media controversy or widespread community discussion has been observed, consistent with the low EPSS score and absence of active exploitation.