CVE-2026-4334

Technical summary

CVE-2026-4334 is a Stored XSS vulnerability in the Shariff Wrapper WordPress plugin. The plugin implements custom sanitization via a modified wp_kses function that allows a broad set of HTML tags. However, after sanitization completes, the plugin performs a str_replace operation that injects HTML content—specifically through the %total placeholder in style attributes—without re-validating the result. This post-sanitization injection permits attackers to embed event handlers (such as onload, onerror) that bypass the initial sanitization layer. The vulnerability requires authenticated access at Contributor level or above, meaning the attacker must have a valid WordPress user account with publishing privileges. The injected payload persists in the database, executing for all users who subsequently access the compromised page.

Business impact

Organizations running Shariff Wrapper face risk of user session compromise, sensitive data exfiltration, and reputation damage. Because the XSS is stored and executes whenever any user views the page, the blast radius extends beyond the initial attacker to all site visitors, including administrators and customers. In a multi-author environment, a lower-privileged employee account could compromise the integrity of pages viewed by executives or customers. For WordPress sites serving as customer portals or marketing platforms, this vulnerability could undermine user trust and trigger compliance violations (e.g., PCI DSS for e-commerce sites).

Affected systems

Shariff Wrapper plugin for WordPress, all versions up to and including 4.6.20. Organizations using this plugin should verify their installed version immediately. The plugin is used primarily for adding social sharing functionality to WordPress sites. Sites that have restricted the Contributor role to trusted staff only face lower risk than those allowing self-registration or contractor access.

Exploitability

Exploitation requires valid WordPress authentication at Contributor level or above. This is a relatively low barrier in organizations with many content creators, freelancers, or contractors. The attack does not require user interaction from victims—the payload executes automatically when any user (including unauthenticated visitors in some configurations) views the compromised page. No advanced technical skills are needed; the attacker simply needs to create or edit a post/page containing a malicious [shariff] shortcode. The CVSS score of 6.4 (Medium) reflects the requirement for authentication, but the stored nature and site-wide impact warrant urgent attention.

Remediation

Update the Shariff Wrapper plugin to a version newer than 4.6.20 as soon as a patch is available from the vendor. Verify the update in the WordPress plugin repository or the vendor's advisory. In the interim, restrict the Contributor role to trusted staff only, review existing pages and posts for suspicious [shariff] shortcodes with unusual headline parameters, and consider disabling the plugin if it is not actively used. Audit user accounts with Contributor access or above to identify and remove compromised or unnecessary accounts.

Patch guidance

Monitor the WordPress plugin repository and the Shariff Wrapper vendor's website for version 4.6.21 or later. Test the update in a staging environment to confirm compatibility with your WordPress version and other active plugins before deploying to production. After updating, perform a full post/page scan to identify and remove any malicious [shariff] shortcodes that may have been injected during the vulnerability window. Enable automatic plugin updates if your hosting environment and security posture permit.

Detection guidance

Search your WordPress database for [shariff] shortcodes containing suspicious or Base64-encoded headline parameters, especially those containing event handler keywords (onload, onerror, onclick, etc.) or javascript: protocols. Enable WordPress logging and monitor for posts/pages edited by lower-privileged accounts if your threat model suggests insider risk. Use web application firewalls (WAF) to detect outbound exfiltration or suspicious DOM manipulation from your WordPress domain. Review WordPress user audit logs for any Contributor-level account activity prior to the vulnerability discovery date.

Why prioritize this

Although the CVSS score is Medium (6.4), this vulnerability warrants high prioritization due to its stored nature, potential for widespread user impact, and low exploitation barrier. Any Contributor can compromise all site visitors. Organizations with permissive user permission models or third-party content authors should treat this as urgent. The vulnerability is neither on the CISA KEV catalog nor marked for active exploitation at publication, but the straightforward injection mechanism makes weaponization trivial.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) is assigned because: Attack Vector is Network (increasing score), Attack Complexity is Low (easy exploitation), Privileges Required is Low (Contributor access), User Interaction is None (no victim action needed), Scope is Changed (the injected script affects the broader web application and user sessions), Confidentiality is Low (potential data leakage), Integrity is Low (page content and user trust are compromised), and Availability is None (no denial of service component). The score does not fully capture the reputational and user-trust damage of a stored XSS on a high-traffic page, so security teams should consider organizational context when prioritizing.

Frequently asked questions