VulnSocial

CVE-2026-3997Disclosure

LOWCVSS 6.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in all versions up to and including 1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the avp_texttoggle_part_shortcode() function, the 'title' attribute is extracted from shortcode attributes and concatenated directly into HTML output without any escaping — both within an HTML attribute context (title="...") on line 116 and in HTML content on line 119. While the 'class' attribute is properly validated using ctype_alnum(), the 'title' attribute has no sanitization whatsoever. An attacker can inject double-quote characters to break out of the title attribute and inject arbitrary HTML attributes including event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-03-21); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-21: 2Mentions · 2026-04-15: 1Technical Details · 2026-03-21: 2Technical Details · 2026-04-15: 103-2104-15
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-212
Disclosure1General1
2026-04-151
Disclosure1
Full discourse3 posts
  • セキュリティ対策Lab@securityLab_jp
    Disclosure

    Laravel Passport、client_credentialsトークンで認証回避が可能になる脆弱性の(CVE-2026-3997) https://rocket-boys.co.jp/security-measures-lab/laravel-passport-authentication-bypass-cve-2026-3997/ #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews

    Post summary

    A new vulnerability (CVE-2026-3997) allowing authentication bypass through Laravel Passport’s client_credentials token has been disclosed, detailing the flaw but providing no PoC, exploit code, or patch information.

    00010137
    380 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-3997 The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in all versio… https://www.cve.org/CVERecord?id=CVE-2026-3997

    Post summary

    The CVE‑2026‑3997 vulnerability is a stored XSS flaw in the WordPress Text Toggle plugin’s title attribute for [tt_part] and [tt] shortcodes, with no PoC, exploit, or mitigation details mentioned.

    0001038
    56.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-3997 Stored XSS in WordPress Text Toggle Plugin via Shortcode Title Attribute https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3997

    Post summary

    The entry provides a generic description of a stored XSS vulnerability in the WordPress Text Toggle Plugin but lacks details on PoC, active exploitation, or mitigation.

    0000035
    4.0K followersView on X

Explore more

Back to dashboard