CVE-2026-8042

Vulnerability

The GitHub Shortcode plugin for WordPress versions up to and including 0.1 fails to sanitize the repo attribute in the github shortcode. This allows stored cross-site scripting (XSS) because user-supplied input is not properly escaped before being output. The vulnerable code is in githubshortcode.php [1].

Exploitation

An attacker must have at least Contributor-level access to the WordPress site. They can create or edit a post/page and insert the [github repo="..."] shortcode with a malicious payload in the repo attribute. When any user views the page, the injected script executes.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's browser. This can result in session hijacking, defacement, or redirection to malicious sites. The attacker does not need elevated privileges beyond Contributor.

Mitigation

As of the publication date (2026-05-27), no fixed version has been released. Users should disable the plugin or apply a web application firewall rule to block malicious shortcode attributes. The plugin appears to be unmaintained; consider removing it entirely.