WordPress Plugin Vulnerabilities

WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

Description

The plugin does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
wp-highlight-box
No known fix

References

CVE
CVE-2026-86790

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Pablo González and Francisco José Ramírez
Submitter
Pablo González and Francisco José Ramírez
Verified
Yes
WPVDB ID
b48571ae-368e-4193-977a-f22fb09db4d4

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2024-06-27
Title
Infinite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter
Published
2024-01-16
Title
Shield Security < 18.5.8 - Unauthenticated Stored Cross-Site Scripting
Published
2026-06-08
Title
RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-01-16
Title
dForms <= 1.0 - Reflected Cross-Site Scripting
Published
2024-12-05
Title
Xpro Addons For Elementor < 1.4.6.6 - Contributor+ Stored XSS