CVE-2026-8701

Vulnerability

The GNTT Post Title Ticker plugin for WordPress version 1.0 contains a stored cross-site scripting (XSS) vulnerability in three shortcodes: title-ticker-slide, title-ticker-fade, and title-ticker-typing. The plugin insufficiently sanitizes and escapes shortcode attributes such as border, width, height, header_background, header_text_color, and id before concatenating them into HTML output within the functions gntt_title_ticker_slide(), gntt_title_ticker_fade(), and gntt_title_ticker_typing() [1][2]. No escaping function like esc_attr() is applied, enabling an attacker to inject malicious HTML attributes or script content.

Exploitation

An authenticated attacker with at least contributor-level access can exploit this vulnerability by inserting a specially crafted shortcode into a post or page. The attacker controls one or more of the unsanitized attributes, like border="1px solid #ddd\" onfocus='alert(1)' autofocus="" or a similar payload that will break out of the attribute context. When a victim visits the affected page, the injected script executes in their browser [1][2]. The shortcode can also be used in widget areas because the plugin adds the do_shortcode filter to widget_text [1][2].

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts that execute in the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack is stored, so the injected payload persists and affects every user who accesses the compromised page [1][2].

Mitigation

As of the publication date (2026-05-27), no patched version of the GNTT Post Title Ticker plugin has been released [1][2]. The vendor should apply proper input sanitization and output escaping (e.g., esc_attr()) to all shortcode attributes in the three affected functions. Until a fix is available, users should restrict contributor-level access to trusted individuals and consider disabling the plugin if it is not essential. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.