CVE-2026-3885 affects Shortcodes Ultimate and is an authenticated Contributor+ stored cross site scripting vulnerability in the su_box shortcode. In versions through 7.4.9, a crafted max_width value can break out of its HTML attribute and add an event handler. The stored browser code runs when a visitor interacts with the affected box.
| CVE | CVE-2026-3885 |
| Plugin Version | Shortcodes Ultimate <= 7.4.9, fixed in 7.5.0 |
| All Time | 25 673 429 |
| Active installations | 400 000+ |
| Publicly Published | April 15, 2026 |
| Last Updated | April 16, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-3885 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shortcodes-ultimate/wp-shortcodes-plugin-shortcodes-ultimate-749-authenticated-contributor-stored-cross-site-scripting-via-su-box-shortcode |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| June 25, 2026 | Plugin testing and vulnerability detection in Shortcodes Ultimate were completed. |
| June 26, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 15, 2026 | CVE-2026-3885 was publicly published by Wordfence. |
Discovery of the Vulnerability
The su_box shortcode accepts layout attributes from users who can submit post content. The max_width value is stored and later placed into generated markup without sufficient sanitization and attribute-context escaping. A crafted value can therefore close the intended attribute and introduce a new browser event handler.
Understanding of Stored XSS attacks
Stored cross site scripting persists attacker-controlled markup in WordPress content or metadata. The payload is delivered again when the affected content is rendered, so the attacker does not need to be present when it executes. A Contributor account is enough to prepare shortcode content, while visitors or privileged users become the execution targets.
Exploiting the Stored XSS Vulnerability
A Contributor can place the crafted su_box shortcode into a post and submit it for review. Once the content is published or previewed by an authorized user, pointer interaction with the generated box triggers the stored event handler.
POC:
POC: 1. Log in with a Contributor or higher WordPress account. 2. Create or edit a post. 3. Insert the shortcode below into the post content. 4. Submit the post for review or publish it with an authorized role. 5. Open the rendered post and move the pointer over the box. [su_box title="XSS" max_width='0" onmouseover="alert(document.domain)" x="']Click or Navigate here[/su_box]____
On a vulnerable version, the payload becomes part of the box markup and executes under the site origin when the event fires.
Recommendations for Improved Security
Site owners should update Shortcodes Ultimate to version 7.5.0 or later. Developers should validate width values against the expected numeric format and escape every value at the point where it enters an HTML attribute. Sites that cannot update immediately should review untrusted shortcode content and limit publishing workflows for low-privileged accounts.
By addressing Stored XSS like CVE-2026-3885, WordPress site owners can reduce the risk from unsafe shortcode attributes and protect visitors from browser-side compromise. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #ShortcodeSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
