CVE-2026-8842

Vulnerability

The Google+ Link Name plugin for WordPress versions up to and including 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) in the gplusnamelink_generate() function, which is registered via the [gplusnamelink] shortcode. The function accepts id and name attributes from the shortcode and concatenates them directly into an ` tag's href and inner content without proper sanitization or output escaping — specifically, it fails to call esc_attr() or esc_html()` on the user-supplied values [1][2]. This allows an attacker who can create or edit posts (e.g., contributor-level or higher) to inject malicious HTML and JavaScript.

Exploitation

An authenticated attacker with at least contributor-level access can create a new post or edit an existing one and insert the [gplusnamelink] shortcode with specially crafted values for the id or name attributes. For example, setting name to `` will cause the unsanitized string to be echoed directly into the page HTML. Since the shortcode is processed on page render, the injected script will execute in the browser of any user who views the affected page. No other special network position or user interaction beyond viewing the page is required [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session theft, credential harvesting, redirection to malicious sites, or defacement. The attacker does not gain direct server-side control but can compromise the integrity and confidentiality of interactions with the WordPress site for any user visiting the infected page [1][2].

Mitigation

As of the publication date (2026-05-27), no fixed version of the Google+ Link Name plugin has been released. The plugin appears to be abandoned (last updated in 2012) and is no longer maintained on the WordPress plugin repository. The recommended mitigation is to immediately remove and deactivate the plugin, as no workaround exists that preserves functionality. Site administrators should also review and remove any pages or posts containing the vulnerable shortcode. The plugin is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at this time [1].