Stored Cross-Site Scripting in Mutual Funds Data Plugin for WordPress

CVE-2026-8869

What is CVE-2026-8869?

The Mutual Funds Data plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Specifically, the issue arises from the 'title' shortcode attribute in the mfd_shortcode() function, which directly concatenates user-supplied input into a element. This vulnerability allows authenticated attackers with Contributor-level access and higher to inject malicious scripts into pages. When users visit these compromised pages, the injected scripts are executed, potentially leading to serious security breaches.

References