CVE-2026-8872

Vulnerability

The Animate Your Content plugin for WordPress versions up to and including 1.0.0 contains a stored cross-site scripting vulnerability in the animation-set shortcode. The shortcode_args_to_html_attrs() function concatenates user-supplied shortcode attribute values directly into double-quoted HTML attributes without calling esc_attr(), leading to insufficient input sanitization and output escaping [1].

Exploitation

An authenticated attacker with contributor-level access or above can insert the animation-set shortcode with malicious attribute values. When the shortcode is rendered, the unsanitized attributes are injected into the HTML, allowing arbitrary JavaScript to be stored and executed in the context of any user visiting the affected page.

Impact

Successful exploitation enables stored cross-site scripting (XSS), allowing the attacker to execute arbitrary web scripts in the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites, compromising the confidentiality and integrity of the WordPress site.

Mitigation

As of the publication date, no patched version has been released. Users are advised to disable the plugin or restrict contributor-level access until a fix is available. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.