CVE-2026-3554 describes a stored cross-site scripting vulnerability in the Sherk Custom Post Type Displays WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'title' attribute in the 'sherkcptdisplays' shortcode. Specifically, the 'title' attribute is extracted via shortcode_atts() and directly concatenated into an HTML <h2> element without escaping in the sherkcptdisplays_func() function. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the affected page. The vulnerability affects all versions up to and including 1.2.1. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized script execution in the browsers of users who view the injected content, potentially resulting in session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not impact availability but affects confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Contributor-level access or higher to trusted users only and avoid using the vulnerable shortcode with untrusted input. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official fixes.