CVE-2026-8893

An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages containing the [stripe-express] shortcode. This is achieved by manipulating the 'type' attribute, which is directly concatenated into an HTML attribute without proper sanitization or escaping. When a user visits a page with the injected script, the script will execute in their browser.

The vulnerability resides within the `register_shortcode()` function in the `wp-stripe-shortcodes.php` file. Specifically, the 'type' attribute, when provided via the [stripe-express] shortcode, is directly used in the output without adequate escaping, as shown in the code snippets from [ref_id=1] and [ref_id=2].

The patch, as indicated by the code snippet in [ref_id=1] and [ref_id=2], addresses the vulnerability by ensuring that the 'type' attribute is properly escaped before being rendered in the HTML output. Although a specific patch file is not provided, the code shows that the 'type' variable, derived from shortcode attributes, is now handled in a way that prevents it from being directly interpreted as executable script. This prevents the injection of malicious code.