CVE-2026-4005
6.4
/ Sedang
0.01%V4
2026-04-15
09h16 +00:00
09h16 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a
