CVE-2026-3997 is a stored cross-site scripting vulnerability in the hoosierdragon Text Toggle WordPress plugin. The issue arises from improper neutralization of user input in the 'title' shortcode attribute of [tt_part] and [tt] shortcodes. Specifically, the avp_texttoggle_part_shortcode() function inserts the 'title' attribute directly into HTML output without escaping, both inside an HTML attribute (title="...") and in HTML content. While the 'class' attribute is validated, the 'title' attribute lacks any sanitization, allowing injection of double-quote characters and arbitrary HTML attributes including event handlers. This enables authenticated users with Contributor or higher privileges to inject persistent scripts that execute when pages are viewed.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject arbitrary JavaScript into pages using the vulnerable shortcodes. This can lead to session hijacking, defacement, or other malicious actions executed in the context of users viewing the injected content. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and avoid using the vulnerable shortcodes with untrusted input. Monitor for plugin updates from hoosierdragon that address this issue and apply them promptly once released.