Stored Cross-Site Scripting Vulnerability in Easy Prism Syntax Highlighter for WordPress

CVE-2026-8875

What is CVE-2026-8875?

The Easy Prism Syntax Highlighter plugin for WordPress is susceptible to stored cross-site scripting attacks. This vulnerability arises from inadequate input sanitization and output escaping in the plugin's shortcode functions. Specifically, the code and c attributes of the shortcode allow authenticated users with contributor-level access or higher to inject malicious scripts directly into the HTML output of pages. Because these scripts execute whenever a user accesses the affected page, this can lead to serious security breaches, including data theft and site defacement.

References