CVE-2026-4083: 
WordPress vulnerability analysis and mitigation

CVE-2026-4083 is a Stored Cross-Site Scripting (XSS) vulnerability in the Scoreboard for HTML5 Games Lite WordPress plugin, affecting all versions up to and including 1.2. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript into pages via the scoreboard shortcode. It was published on March 21, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable sfhg_shortcode() function renders an <iframe> element and passes arbitrary shortcode attributes directly into it, blocking only four attribute names (same_height_as, onload, onpageshow, onclick). Although attribute names are sanitized with esc_html() and values with esc_attr(), these functions do not strip or encode JavaScript event handler attribute names such as onfocus, onmouseover, or onmouseenter, since those strings contain no characters altered by the escaping routines. Critically, the shortcode is stored in post_content and expanded to HTML at render time — after WordPress's kses content filtering has already run — meaning the injected event handlers bypass WordPress's built-in sanitization pipeline entirely (Wordfence, Plugin Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who visits a page containing the injected shortcode. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of browser-based exploits. The scope is marked as Changed, meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site. Confidentiality and integrity are both rated Low impact, with no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.042%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Scoreboard for HTML5 Games Lite ≤ 1.2.
2. Create or edit a post: Navigate to the WordPress post editor and create or edit a post where the [scoreboard] shortcode can be inserted.
3. Inject malicious shortcode: Insert a shortcode with a non-blacklisted JavaScript event handler attribute, for example:

   [scoreboard onfocus="alert(document.cookie)"]

   Since onfocus is not in the four-item blocklist and contains no characters modified by esc_html(), it passes through sanitization intact.
4. Publish the post: Submit the post for publication or review. The shortcode payload is stored in post_content before WordPress's kses filter can strip it, as kses operates on raw content rather than shortcode output.
5. Trigger execution: When any site visitor loads the affected page, the <iframe> is rendered with the injected event handler attribute. Interaction (e.g., focusing the iframe) triggers the JavaScript payload in the victim's browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing [scoreboard shortcode strings with event handler attributes (e.g., onfocus=, onmouseover=, onmouseenter=).
• Database: Entries in the wp_posts table (post_content column) containing [scoreboard shortcodes with unexpected HTML attributes beyond standard plugin parameters.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits — indicative of XSS payload beaconing or cookie exfiltration.
• File System: Unexpected modifications to plugin files under wp-content/plugins/scoreboard-for-html5-game-lite/ that may indicate secondary tampering after initial access.

The primary remediation is to update the Scoreboard for HTML5 Games Lite plugin to a version beyond 1.2 that addresses this vulnerability. The patch commit is available in the plugin's SVN repository (Plugin Changeset). As a workaround, site administrators should restrict Contributor-level user registration and review existing Contributor accounts for unauthorized use. Additionally, a Web Application Firewall (WAF) rule blocking event handler attributes in shortcode parameters can provide interim protection until patching is complete (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which maintains the primary advisory. No notable independent researcher commentary, media coverage, or significant social media discussion has been identified beyond standard CVE aggregator listings (Wordfence).