Stored Cross-Site Scripting Vulnerability in Shortcode Buddy for WordPress

CVE-2026-8897

What is CVE-2026-8897?

The Shortcode Buddy plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in all versions up to and including 0.1.9.5. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious scripts into pages, which execute when other users access the compromised pages. This can lead to significant security risks, including the unauthorized execution of scripts in the context of the affected user’s session.

References