Stored Cross-Site Scripting in WP Highlight Box Plugin by WordPress
CVE-2026-86790
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
What is CVE-2026-86790?
The WP Highlight Box plugin allows for the integration of reusable content blocks through shortcodes. However, versions up to and including 1.0 lack proper escaping for certain shortcode attributes prior to rendering on a page. This oversight can lead to stored cross-site scripting vulnerabilities, enabling users with contributor privileges or higher to inject malicious scripts into the site's content. It is critical for site administrators to assess their plugin versions and implement appropriate measures to mitigate this risk.
Affected Version(s)
WP Highlight Box 0 <= 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.