CVE-2026-3885 is a stored cross-site scripting vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress, specifically in the 'su_box' shortcode. The issue is caused by improper neutralization of input during web page generation, allowing authenticated users with contributor-level permissions or higher to inject malicious scripts via insufficiently sanitized shortcode attributes. These scripts execute in the context of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to 7.4.9. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required (low), no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix has been confirmed.

An attacker with contributor-level or higher access can inject malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the user. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if possible. Monitor for updates from the vendor regarding patches or official mitigations.