CVE-2026-8869

Vulnerability

The Mutual Funds Data plugin for WordPress versions up to and including 1.2.1 is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the mfd_shortcode() function, specifically through the user-supplied title attribute of the shortcode. Input sanitization and output escaping are insufficient; the title value is concatenated directly into the HTML output within a `` element [1][2].

Exploitation

An authenticated attacker with at least Contributor-level access can inject arbitrary web scripts by providing a malicious title attribute value when inserting the plugin's shortcode on a page or post. No additional network position or user interaction beyond typical post editing is required. The injected script is stored in the WordPress database and executes when any user views the affected page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of a victim's browser session when they visit the compromised page. This can lead to session cookie theft, page content manipulation, or redirection to malicious sites, potentially compromising the victim's WordPress account and data.

Mitigation

The vendor has not yet released a patched version according to the available references. Users should disable or remove the Mutual Funds Data plugin until a fixed version is published. No workaround is provided in the references. The plugin may be considered for removal if no update is forthcoming.