Stored Cross-Site Scripting in Post Category Gallery Plugin for WordPress

CVE-2026-8867

What is CVE-2026-8867?

The Post Category Gallery plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability resulting from inadequate input sanitization and output escaping on user-defined shortcode attributes such as total_width, color_scheme, and caption_font_size. This flaw exists within the sc_horcatbar() function, where these attributes are directly placed into HTML attribute values. Consequently, authenticated attackers with contributor-level access or higher can inject malicious web scripts that execute when a user views affected pages, exposing them to potential security threats.

References