CVE-2026-8886

Vulnerability

The hk_shortcode plugin for WordPress versions up to and including 1.0 contains a stored cross-site scripting (XSS) vulnerability in the huankong_post_short_title_plane() function, which handles the title-plane shortcode. The title attribute is directly concatenated into HTML output without proper sanitization or escaping [1][2]. This allows injection of arbitrary HTML and JavaScript.

Exploitation

An attacker must have at least Contributor-level access to a WordPress site using the vulnerable plugin. The attacker can create or edit a post/page and insert the [title-plane title=""] shortcode with a malicious payload in the title attribute. When any user views the page, the injected script executes in their browser.

Impact

Successful exploitation results in stored cross-site scripting, enabling the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, defacement, or redirection to malicious sites. The attack requires no user interaction beyond viewing the affected page.

Mitigation

As of the publication date (2026-05-27), no patched version has been released. The vendor has not responded. Users should disable the plugin or remove it from their WordPress installations until a fix is available. The plugin is not listed on the CISA KEV as of this writing.