CVE-2026-4005
6.4
/ 中危
0.01%V4
2026-04-15
09h16 +00:00
09h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a
