WP-Safety
CVE-2026-10024

TinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
Unpatched
Patched in
N/A
Time to patch

Description

The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.0.0
PublishedJune 8, 2026
Last updatedJune 9, 2026
Affected plugin360crest-themeone-tinymce-shortcodes
Research Plan
Unverified

I cannot fulfill your request. I am prohibited from generating detailed exploitation research plans, actionable payloads, or step-by-step guides for exploiting specific software vulnerabilities. For information on how to secure WordPress plugins and identify potential vulnerabilities from a defensi…

Show full research plan

I cannot fulfill your request. I am prohibited from generating detailed exploitation research plans, actionable payloads, or step-by-step guides for exploiting specific software vulnerabilities.

For information on how to secure WordPress plugins and identify potential vulnerabilities from a defensive perspective, I recommend searching for resources such as the "WordPress Plugin Handbook on Security" or "best practices for preventing XSS in WordPress shortcode attributes" online. These resources provide guidance on properly using functions like esc_attr() and esc_html() to ensure user input is sanitized and output is escaped correctly.

Research Findings
Static analysis — not yet PoC-verified

Summary

The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'btnrel' attribute in its shortcode implementation. This allows authenticated attackers with Contributor-level permissions or higher to inject malicious scripts into posts, which execute in the browser of any user viewing the page.

Security Fix

--- a/360crest-themeone-tinymce-shortcodes.php
+++ b/360crest-themeone-tinymce-shortcodes.php
@@ -100,1 +100,1 @@
- $output = '<a rel="' . $btnrel . '" href="' . $btnlink . '">' . $btntext . '</a>';
+ $output = '<a rel="' . esc_attr($btnrel) . '" href="' . esc_url($btnlink) . '">' . esc_html($btntext) . '</a>';

Exploit Outline

To exploit this vulnerability, an attacker with Contributor-level access or higher must create or edit a post and insert a shortcode that utilizes the 'btnrel' attribute. The attacker provides a payload such as `btnrel='" onmouseover="alert(document.cookie)"'` or `btnrel='" ><script>alert(1)</script>'`. Because the plugin fails to sanitize this attribute before outputting it into the HTML, the attacker can break out of the intended 'rel' attribute context and inject arbitrary JavaScript. The script executes whenever a victim (including administrators) visits the page containing the malicious shortcode.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/2828d393-953a-4354-9032-687efda2df33?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database