Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. The shortcode reads post meta from a user-specified post ID and echoes these values directly into HTML output without any escaping functions (no esc_attr(), esc_url(), or esc_html()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | Disclosure1 |
| 2026-04-24 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-4088-switch-cta-box-version-1-1-medium-vulnerability-proof-of-concept CVE-2026-4088 #WordPress plugin #vulnerability switch-cta-box #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The tweet links to a page that shares a proof‑of‑concept for CVE‑2026‑4088, indicating the presence of a medium‑severity flaw in the Switch CTA Box WordPress plugin.
CVE-2026-4088 The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is… https://www.cve.org/CVERecord?id=CVE-2026-4088
Post summary
The Switch CTA Box plugin for WordPress is disclosed to have a stored XSS flaw via a shortcode; no exploits, patches, or active usage are referenced.