CVE-2026-4078 | ITERAS Plugin up to 1.8.2 on WordPress Shortcode combine_attributes cross site scripting

A vulnerability has been found in ITERAS Plugin up to 1.8.2 on WordPress and classified as problematic. Affected by this issue is the function combine_attributes of the component Shortcode Handler. The manipulation leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-4078. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.