CVE-2026-1809 is a stored cross-site scripting vulnerability in the jhoylman HTML Shortcodes WordPress plugin, affecting all versions up to 1.1. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), specifically due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This flaw allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. The CVSS 3.1 score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability and requires authentication, limiting its scope. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the HTML Shortcodes plugin until a fix is released. Avoid using shortcode attributes that accept user input from untrusted sources.