CVE-2026-4005: 
WordPress vulnerability analysis and mitigation

CVE-2026-4005 is a Stored Cross-Site Scripting (XSS) vulnerability in the Coachific Shortcode plugin for WordPress, affecting all versions up to and including 1.0. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the userhash shortcode attribute, which execute in the browsers of any user visiting an affected page. It was published on April 15, 2026, with a patch referenced in the GitHub Advisory Database on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of input during web page generation (CWE-79). The plugin applies sanitize_text_field() to the userhash shortcode parameter, which strips HTML tags but does not escape characters meaningful in a JavaScript string context — specifically double quotes, semicolons, and parentheses. The sanitized value is then directly interpolated into a JavaScript string inside a <script> tag at line 29 of coachific.php without JavaScript-specific escaping functions such as wp_json_encode() or esc_js(). This allows an attacker to break out of the JavaScript string context and inject arbitrary script code (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, or distribution of malware to site visitors. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality and integrity impact and no availability impact (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires Contributor-level authentication, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.032% (0.000320), placing it in the 2nd percentile for exploitation likelihood within 30 days (GitHub Advisory). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Coachific Shortcode plugin version 1.0 or earlier.
2. Craft Malicious Shortcode: Create or edit a post/page and insert the Coachific shortcode with a crafted userhash attribute that breaks out of the JavaScript string context, e.g., [coachific userhash="";alert(document.cookie);//"].
3. Publish the Page: Submit or publish the page containing the injected shortcode. The malicious payload is stored in the WordPress database.
4. Trigger Execution: When any user (including administrators) visits the affected page, the browser renders the <script> tag containing the unsanitized userhash value, executing the injected JavaScript.
5. Achieve Objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, redirect users to phishing pages, or deliver malware (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing shortcode content with JavaScript-breaking characters (e.g., ";, );, //) in the userhash parameter.
• Database: WordPress wp_posts table entries containing [coachific userhash= shortcode with embedded JavaScript payloads (e.g., alert(, document.cookie, fetch(, <script>).
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after visiting pages containing the Coachific shortcode; unexpected data exfiltration via HTTP GET/POST to external URLs.
• File System: Review coachific.php line 29 for any unauthorized modifications to the plugin file that may indicate tampering beyond the shortcode injection vector.

Update the Coachific Shortcode plugin to a patched version as referenced in the GitHub Advisory (GHSA-953c-p36c-7pc3), available as of April 22, 2026 (GitHub Advisory). If immediate patching is not possible, restrict Contributor-level access to only fully trusted users, as the vulnerability requires at least that privilege level. Additionally, consider deploying a Web Application Firewall (WAF) with rules to detect and block script injection attempts in shortcode parameters, and audit existing pages for any previously injected malicious userhash values (Wordfence).

Wordfence identified and disclosed this vulnerability as part of their weekly WordPress vulnerability report for April 13–19, 2026, and assigned it a moderate severity rating (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified for this vulnerability.