The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
The attacker needs a WordPress account with the Contributor role or higher on a site with the plugin active. Contributor-authored content is executed once an Editor or Administrator publishes it.
Until updated, deactivate the plugin or do not allow untrusted Contributor/Author-level users to publish content containing the [bs_tcontent] shortcode.
Update the Bootstrap Shortcodes plugin to version 3.4.6 or later.