Stored Cross-Site Scripting Vulnerability in Instant-Quote.co Plugin for WordPress

CVE-2026-8884

What is CVE-2026-8884?

The Instant-Quote.co Quotation Page plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access and higher to exploit inadequate input sanitization and output escaping mechanisms. This flaw enables attackers to inject arbitrary web scripts via shortcode attributes, leading to the execution of malicious scripts when a user accesses the affected page. Notably, an attacker can embed malicious shortcodes within a post that, when submitted for review, can execute scripts against higher-privileged users, such as administrators, upon their interaction with the post.

References