CVE-2026-4279

Description

The Bread & Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the -breadbutter-customevent-button- shortcode in all versions up to, and including, 8.2.0.25. This is due to insufficient input sanitization and output escaping on the -event- shortcode attribute. The customEventShortCodeButton() function takes the -event- attribute value and directly interpolates it into a JavaScript string within an onclick HTML attribute without applying esc_attr() or esc_js(). Notably, the sister function customEventShortCode() properly uses esc_js() for the same attribute, but this was omitted in the button variant. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page and clicks the injected button.