WP Highlight Box shortcode attributes permit stored XSS
WP Highlight Box through 1.0 outputs some shortcode attributes without escaping them. A contributor or higher role can place attacker-controlled markup in a page containing the shortcode, causing JavaScript to execute when the page is viewed. The authoritative export does not identify the shortcode tag, affected attributes, or output contexts.
- Component
- WP Highlight Box
- Plugin slug
wp-highlight-box- Affected
- <= 1.0
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed release is confirmed in the authoritative export. Restrict use of the shortcode or deactivate the plugin. The application-level fix must validate attributes by expected type and escape each value at the HTML attribute, URL, or text sink where it is rendered.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H