Shariff for WordPress <= 1.0.11 – Admin+ Stored Cross-Site Scripting | CVE 2026-9677

Description

The Shariff for WordPress plugin does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Log in as an Administrator
2. Go to Settings > Shariff (wp-admin/options-general.php?page=shariff)
3. Intercept the settings save request and inject the following payload into the shariff_infourl parameter:

"><img src=x onerror=alert(document.domain)>

4. Visit any published post page (even as an unauthenticated user)
5. The XSS payload executes because the Info URL value is output unescaped in the data-info-url HTML attribute