CVE-2026-9635

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-shortcode/trunk/wp-shortcode.php#L766
• https://plugins.trac.wordpress.org/browser/wp-shortcode/trunk/wp-shortcode.php#L774
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6f3bcf70-2900-4a13-9ed4-264a15af9725?source=cve

Published

Jul 23, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9626The JSON API User plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-9627A security flaw has been discovered in UTT HiPER 1200GW up t…8.8
• CVE-2026-9628A weakness has been identified in UTT HiPER 1200GW up to 2.5…8.8
• CVE-2026-9629The Canvas plugin for WordPress is vulnerable to Stored Cros…6.4
• CVE-2026-9631A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-9632A flaw has been found in UTT HiPER 1250GW up to 3.2.7-210907…8.8
• CVE-2026-9636A security issue exists within CompactLogix® 5380, ControlLo…8.2
• CVE-2026-9638Crypt::PBKDF2 versions before 0.261630 for Perl generate ins…7.5
• CVE-2026-9639Nil-pointer dereference in CreateCustomVolumeFromBackup in L…6.5
• CVE-2026-9640A privilege escalation vulnerability exists in LXD from 6.0 …7.2
• CVE-2026-9641Crypt::PBKDF2 versions before 0.261630 for Perl have a weak …5.3
• CVE-2026-9642Rejected reason: This CVE ID has been rejected or withdrawn …