CVE-2026-4279: 
WordPress vulnerability analysis and mitigation

CVE-2026-4279 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bread & Butter (AI-Powered Lead Intelligence) plugin for WordPress, affecting all versions up to and including 8.2.0.25. The flaw resides in the breadbutter-customevent-button shortcode, where the event attribute is directly interpolated into a JavaScript string within an onclick HTML attribute without proper escaping. It was published on April 22, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an inconsistency in output escaping between two related functions in src/Base/Shortcode.php. The customEventShortCodeButton() function directly interpolates the event shortcode attribute into a JavaScript string inside an onclick HTML attribute without calling esc_attr() or esc_js(), while the sister function customEventShortCode() correctly applies esc_js() for the same attribute. An authenticated attacker with at least Contributor-level access can craft a malicious [breadbutter-customevent-button event="..."] shortcode containing arbitrary JavaScript, which is then stored in the page and executes in the browser of any visitor who clicks the injected button (GitHub Advisory, WordPress Trac).

Successful exploitation allows authenticated contributors to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any site visitor who clicks the injected button. This can lead to session hijacking, credential theft, malware distribution, or unauthorized actions performed on behalf of affected users. The scope is changed (S:C), meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors, with low confidentiality and integrity impacts (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires at least Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.011% (2nd percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Bread & Butter plugin at version 8.2.0.25 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at /wp-content/plugins/bread-butter/readme.txt.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post/page where shortcodes are rendered.
4. Inject Malicious Shortcode: Insert a crafted shortcode such as [breadbutter-customevent-button event="");alert(document.cookie);//"] or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
5. Publish the Page: Submit the post for review or publish it (depending on role permissions). The malicious script is now stored in the database.
6. Trigger Execution: When a site visitor loads the affected page and clicks the injected button, the onclick handler executes the attacker's JavaScript in the visitor's browser context, enabling session hijacking or further exploitation (GitHub Advisory, WordPress Trac).

• Logs: WordPress database or post content containing breadbutter-customevent-button shortcodes with suspicious event attribute values (e.g., containing <script>, javascript:, alert(, document.cookie, or encoded variants).
• File System: Unexpected modifications to posts or pages in the WordPress database (wp_posts table) referencing the breadbutter-customevent-button shortcode with unusual attribute values.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after page load, potentially carrying session tokens or cookies (indicative of XSS-based exfiltration).
• Browser/Application Logs: JavaScript errors or unexpected network requests logged in browser developer tools when visiting pages containing the vulnerable shortcode.

Update the Bread & Butter plugin to a version beyond 8.2.0.25 that includes the fix applying esc_attr() or esc_js() to the event attribute in customEventShortCodeButton(). As an interim measure, audit all posts and pages for suspicious breadbutter-customevent-button shortcode usage and restrict Contributor-level access to trusted users only. Deploying a Web Application Firewall (WAF) with XSS detection rules can help block exploitation attempts while patching is underway (GitHub Advisory, Wordfence).

Wordfence identified and disclosed this vulnerability, publishing it in their threat intelligence database and including it in their weekly WordPress vulnerability report for April 20–26, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed (Wordfence Weekly Report).