CVE-2026-4005 is a stored cross-site scripting vulnerability in the Coachific Shortcode WordPress plugin affecting all versions up to 1.0. The issue arises because the 'userhash' shortcode attribute is sanitized only with sanitize_text_field(), which removes HTML tags but fails to escape characters significant in JavaScript strings. The sanitized input is then embedded directly into a JavaScript string within a <script> tag without proper JavaScript escaping functions like wp_json_encode() or esc_js(). This allows authenticated users with Contributor-level privileges or higher to inject malicious scripts that execute in the context of any user viewing the page containing the shortcode. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity) with network attack vector, low attack complexity, and privileges required.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and integrity impacts, such as theft of session tokens or manipulation of page content. There is no indication of availability impact. No known exploits are reported in the wild at this time.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access carefully and avoid using the vulnerable shortcode with untrusted input. Monitoring for updates from the vendor is recommended.