Stored Cross-Site Scripting in Google+ Link Name Plugin for WordPress

CVE-2026-8842

What is CVE-2026-8842?

The Google+ Link Name plugin for WordPress exhibits a vulnerability due to inadequate input validation and output escaping in the 'gplusnamelink' shortcode. Specifically, user-supplied attributes ('id' and 'name') are directly integrated into the generated HTML within the gplusnamelink_generate() function. This oversight allows authenticated attackers with contributor-level access or higher to inject harmful scripts into web pages, which can be executed when users subsequently view the compromised pages, leading to potential data theft or site compromise.

References