CVE-2026-4334

Vulnerability

The Shariff Wrapper plugin for WordPress versions up to and including 4.6.20 contains a Stored Cross-Site Scripting (XSS) vulnerability in the [shariff] shortcode's headline parameter [1][2][4]. The plugin uses a custom wp_kses implementation that allows a permissive set of HTML tags and then performs a str_replace operation on the sanitized output to replace the %total placeholder with dynamic content. Because this replacement occurs after the wp_kses sanitization, an attacker can inject arbitrary HTML event handlers inside the style attribute, effectively bypassing the sanitization. The vulnerability is accessible to authenticated users with Contributor-level access or higher, as they can create or edit posts containing the shortcode.

Exploitation

An attacker with Contributor-level permissions inserts the [shariff] shortcode into a post or page and sets the headline parameter to a crafted value that includes an event handler, for example onmouseover, within the %total placeholder. The str_replace later injects this HTML into the shortcode output, which is then stored and executed when any user visits the affected page. The attacker only needs to be able to create or edit posts using the shortcode, which is a standard capability for Contributor-level and above users in WordPress.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of any user who views the compromised page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is limited to the stored XSS execution scope, but since the injected script runs in the victim's browser, it can access cookies, local storage, and perform actions on behalf of the victim.

Mitigation

As of the publication date (2026-05-28), no fixed version has been released. Users should disable the [shariff] shortcode or restrict its use to trusted user roles as a temporary workaround. Administrators can also apply a content security policy (CSP) that blocks inline event handlers. The vendor is expected to release a patched version that properly escapes or sanitizes the headline parameter after the str_replace step. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.