Stored Cross-Site Scripting Vulnerability in Tuxquote Plugin for WordPress

CVE-2026-8846

What is CVE-2026-8846?

The Tuxquote plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks through the 'TUXQUOTE' shortcode. This vulnerability arises from inadequate input sanitization and output escaping for user-supplied attributes such as 'title', 'align', and 'width'. When these attributes are processed by the tuxquote_build_format() function, they are inserted directly into the rendered HTML without using the necessary security functions like esc_attr() or esc_html(). As a result, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into WordPress pages, leading to potential exploitation when unsuspecting users access the compromised pages.

References