CVE-2026-3885 is a stored cross-site scripting vulnerability in the Shortcodes Ultimate – Content Elements WordPress plugin by gn_themes. The flaw exists in the 'su_box' shortcode where user input is not properly sanitized or escaped, enabling authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 7.4.9. The CVSS v3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of the victim. The vulnerability does not require user interaction (no UI needed) and has network attack vector. The impact includes limited confidentiality and integrity loss but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Shortcodes Ultimate plugin if possible. Monitor plugin updates from gn_themes for a security patch addressing this issue.