CVE-2026-9635 is a stored cross-site scripting vulnerability in the WP Shortcode by MyThemeShop WordPress plugin. The issue arises from insufficient input sanitization and output escaping in the mts_tabs() function, which directly inserts the 'title' shortcode attribute into HTML anchor tags. This allows authenticated users with contributor or higher privileges to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The vulnerability affects versions up to and including 1.4.17. No official patch or remediation level has been provided in the available data.

An attacker with contributor-level access or higher can inject malicious JavaScript code via the 'title' parameter of the [tab] shortcode. This code executes in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected shortcode if possible. Monitor official MyThemeShop communications for updates or patches addressing this vulnerability.