CVE-2026-8871

Vulnerability

The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.1.01. The flaw resides in the FrmKinetic::link() function, where shortcode attributes ('window', 'class', and 'label') are insufficiently sanitized and output-escaped before being concatenated directly into HTML attributes of an anchor tag. An attacker with contributor-level access or higher can supply malicious payloads via the [kinetic_link] shortcode, which will be stored and later executed in the browser of any user viewing the injected page [1][2].

Exploitation

To exploit the vulnerability, an authenticated attacker must have at least contributor-level permissions in WordPress. The attacker inserts a page or post containing a crafted [kinetic_link] shortcode with malicious JavaScript in one of the affected attributes (e.g., window, class, or label). The plugin's code does not sanitize these values before building the HTML output, so the injected script is stored in the database. When a victim visits the affected page, the script executes in their browser, performing the attacker's desired actions [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's WordPress session. The impact includes information disclosure, session hijacking, defacement of the affected page, and potential escalation of privileges if the victim is an administrator. The attack requires no unusual user interaction beyond viewing the compromised page, and the script can perform any action the logged-in user is permitted to do [1][2].

Mitigation

As of the publication date (2026-05-27), no patched version has been released. Administrators should restrict contributor-level access to trusted users only, apply the principle of least privilege, and consider using a web application firewall (WAF) to block malicious shortcode attributes. Additionally, manually sanitizing and escaping the vulnerable attributes in the plugin's source code can serve as a temporary workaround until an official update is provided [1][2].