Description
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Bootstrap Shortcodes project Bootstrap Shortcodes
Default version status: unaffected
0 to < 3.4.6affected
References
- https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b ↗
- https://wordpress.org/plugins/bootstrap-shortcodes/#developers ↗
- https://github.com/TheWebShop/bootstrap-shortcodes/releases/tag/3.4.6 ↗
- https://plugins.trac.wordpress.org/browser/bootstrap-shortcodes/tags/3.4.4/inc/bs_tabs.php#L84 ↗
- https://wordpress.org/plugins/bootstrap-shortcodes/ ↗