CVE-2026-4075

The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L46
• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L73
• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/tags/1.1.1/includes/shortcodes/baf_faq_list.php#L75
• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L46
• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L73
• https://plugins.trac.wordpress.org/browser/bwl-advanced-faq-manager-lite/trunk/includes/shortcodes/baf_faq_list.php#L75
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3487104%40bwl-advanced-faq-manager-lite&new=3487104%40bwl-advanced-faq-manager-lite&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ef01f05a-ed5a-4278-acab-029c58242cf2?source=cve

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40744Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2026-40745Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2026-40746Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8…9.9
• CVE-2026-40747Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 …9.9
• CVE-2026-40748Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 …9.9
• CVE-2026-40749Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 ve…9.9
• CVE-2026-40750Unrestricted Upload of File with Dangerous Type vulnerabilit…9.9
• CVE-2026-40751Unauthenticated PHP Object Injection in Ashtanga <= 1.2 vers…8.1
• CVE-2026-40752Unauthenticated PHP Object Injection in Manufaktur Solutions…8.1
• CVE-2026-40753Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 v…8.1
• CVE-2026-40754Unauthenticated PHP Object Injection in Roisin <= 1.4 versio…8.1
• CVE-2026-40755Unauthenticated PHP Object Injection in TechLink <= 1.3 vers…8.1