Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-9635 Stored Cross-Site Scripting in WP Shortcode by MyThemeShop Plugin Versions Up to 1.4.17 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9635
Post summary
The post announces a stored XSS flaw in MyThemeShop’s WordPress plugin (versions ≤ 1.4.17) but provides only basic technical details, with no proof‑of‑concept, patch, or evidence of exploitation.