CVE-2026-0738: 
WordPress vulnerability analysis and mitigation

CVE-2026-0738 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress. It affects all versions up to and including 7.4.8, allowing authenticated attackers with author-level access or above to inject arbitrary web scripts via the su_carousel shortcode's su_slide_link attachment meta field. The vulnerability was published on April 4, 2026, with a patch released in version 7.4.9. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), stemming from insufficient input sanitization and output escaping in the su_slide_link attachment meta field processed by the su_carousel shortcode handler in includes/shortcodes/carousel.php. An authenticated attacker with at least author-level WordPress privileges can craft a malicious value for the su_slide_link field that is stored in the database and rendered unsanitized in page output. The fix is visible in the plugin's SVN changeset between versions 7.4.8 and 7.4.9 (GitHub Advisory, WordPress SVN).

Successful exploitation allows injected scripts to persist in the WordPress database and execute in the browsers of any user who visits the affected page, including administrators. This enables session hijacking, credential theft, unauthorized actions performed on behalf of visitors, defacement, and potential malware distribution. Because the scope is changed (S:C in CVSS), the impact extends beyond the plugin itself to the broader WordPress site and its visitors (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.01% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the author level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running WP Shortcodes Plugin — Shortcodes Ultimate version 7.4.8 or earlier, using tools like WPScan or by inspecting plugin version metadata in publicly accessible readme files.
2. Obtain author-level access: Authenticate to the WordPress site with an account that has at minimum author-level privileges (e.g., via compromised credentials, social engineering, or a registered contributor account).
3. Create or edit a post with the carousel shortcode: Insert the [su_carousel] shortcode into a post or page, attaching media items to the carousel.
4. Inject malicious payload: Set the su_slide_link attachment meta field for a carousel slide to a value containing a malicious JavaScript payload (e.g., javascript:alert(document.cookie) or an event-handler-based XSS string) that bypasses any existing sanitization.
5. Publish the content: Save and publish the post or page, causing the malicious script to be stored in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the page containing the carousel, the injected script executes in their browser, enabling session token theft, credential harvesting, or further attacks (GitHub Advisory, Wordfence).

• Database/Content: Posts or pages containing [su_carousel] shortcodes where the su_slide_link attachment meta field includes JavaScript URIs (e.g., javascript:), <script> tags, or event handler attributes (e.g., onerror=, onload=).
• Logs: WordPress audit logs or server access logs showing author-level users editing carousel-containing posts or modifying attachment metadata around the time of suspected compromise.
• Network: Outbound requests from visitor browsers to unexpected third-party domains (e.g., attacker-controlled data exfiltration endpoints) originating from pages using the su_carousel shortcode.
• File System: Unexpected modifications to includes/shortcodes/carousel.php or related plugin files if an attacker escalated access beyond content injection.

Update the WP Shortcodes Plugin — Shortcodes Ultimate to version 7.4.9 or later, which contains the fix for improper output escaping in the su_slide_link field (WordPress SVN). As interim measures, restrict author-level access to only fully trusted users, audit existing pages using the su_carousel shortcode for suspicious content in the su_slide_link field, and consider deploying a Web Application Firewall (WAF) with rules targeting WordPress XSS patterns. Monitor user activity and page modification logs for unauthorized changes (Wordfence).

The vulnerability was reported by Wordfence and independently noted by CleanTalk Research, with coverage appearing in Sucuri's April 2026 vulnerability patch roundup (Sucuri Blog). Community reaction has been limited given the medium severity rating and the requirement for authenticated access. No significant social media controversy or major media coverage has been identified beyond standard vulnerability aggregator postings.