CVE-2026-1099

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versions up to, and including, 0.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
shazdeh	Administrative Shortcodes	<= 0.3.4

References

Timeline

Published: Jan 24, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-109909.6Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti CVE-2026-1099009.6Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue CVE-2026-1099018.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calenda CVE-2026-1099037.8A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland bef CVE-2026-1099046.9A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 CVE-2026-109918.8Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gesture CVE-2026-109926.5Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive CVE-2026-1099247.5undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSou CVE-2026-1099258.6The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowin CVE-2026-1099264.3The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce CVE-2026-1099277.2The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user CVE-2026-1099287.4Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on