CVE-2026-8842: Google+ Link Name Plugin XSS Vulnerability

CVE-2026-8842 Overview

CVE-2026-8842 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Google+ Link Name plugin for WordPress in versions up to and including 1.0. The flaw resides in the gplusnamelink shortcode and stems from insufficient input sanitization and output escaping on user-supplied id and name attributes processed by the gplusnamelink_generate() function. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Injected scripts execute in the browser of any user who views the affected page, enabling session hijacking, redirection, or unauthorized actions in the victim's context. The vulnerability is categorized under [CWE-79].

Critical Impact
Contributor-level WordPress accounts can persistently inject JavaScript that executes against all site visitors, including administrators.

Affected Products

Google+ Link Name plugin for WordPress
All versions up to and including 1.0
Sites where contributor or higher accounts can use the gplusnamelink shortcode

Discovery Timeline

2026-05-27 - CVE-2026-8842 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8842

Vulnerability Analysis

The Google+ Link Name plugin registers a gplusnamelink shortcode that renders HTML based on attributes supplied by the content author. The gplusnamelink_generate() function reads the id and name attributes from the shortcode and concatenates them directly into the resulting HTML markup. The function does not invoke WordPress escaping primitives such as esc_attr() or esc_html() before output. This allows shortcode authors to break out of attribute context and inject arbitrary script payloads. Because shortcodes are stored within post content, the payload persists in the database and executes every time the affected post or page is rendered. Stored XSS in this context is particularly impactful on multi-author WordPress sites where contributors can submit content reviewed and published by higher-privileged users.

Root Cause

The root cause is missing output encoding in the shortcode rendering path. WordPress provides esc_attr() for HTML attribute values and esc_html() for textual content, but neither is applied in gplusnamelink_generate(). Direct string concatenation of user-controlled attributes into HTML produces an injection sink classified under [CWE-79].

Attack Vector

An authenticated user with at least contributor privileges submits a post containing the gplusnamelink shortcode where the id or name attribute carries crafted markup that closes the surrounding attribute and introduces an event handler or <script> element. When the post is rendered, the unescaped attribute is emitted into the page, and the injected script executes in the browser of every viewer. Administrators reviewing the contributor submission are also exposed, enabling potential account takeover through stolen session cookies or forged administrative requests. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review for the vulnerable lines.

Detection Methods for CVE-2026-8842

Indicators of Compromise

Post or page content containing [gplusnamelink ...] shortcodes with id or name attribute values containing <, >, ", ', javascript:, or on*= event handler patterns
Unexpected <script> tags or inline event handlers appearing in rendered pages that use the Google+ Link Name plugin
Anomalous outbound requests from visitor browsers to attacker-controlled domains after viewing affected pages

Detection Strategies

Query the wp_posts table for post_content entries containing gplusnamelink and inspect attribute values for HTML metacharacters or script keywords
Review WordPress audit logs for contributor-level accounts publishing or editing posts that include the vulnerable shortcode
Use web application firewall rules to flag shortcode attributes containing encoded or raw script payloads

Monitoring Recommendations

Monitor creation and modification events on posts authored by contributor-role accounts for shortcode usage
Alert on outbound JavaScript fetches from rendered WordPress pages to untrusted hosts via Content Security Policy reporting
Track plugin inventory and version drift to ensure the vulnerable plugin is identified across all hosted WordPress instances

How to Mitigate CVE-2026-8842

Immediate Actions Required

Deactivate and remove the Google+ Link Name plugin until a patched release is published, as version 1.0 and earlier remain vulnerable
Audit existing posts and pages for the gplusnamelink shortcode and remove or sanitize any suspicious id or name attribute values
Restrict contributor-level account creation and review pending submissions from low-privilege users before publication

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD record for CVE-2026-8842. Administrators should track the WordPress plugin repository for an updated release and apply the patched version immediately once available. A fix requires wrapping the id and name attribute outputs in esc_attr() within gplusnamelink_generate().

Workarounds

Remove the plugin entirely, as the Google+ social platform has been discontinued and the plugin offers limited ongoing utility
Limit shortcode usage by filtering gplusnamelink out of allowed shortcodes for non-administrator roles using a custom do_shortcode filter
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of injected payloads
Apply web application firewall rules that block HTML metacharacters in shortcode attribute values

bash

# Configuration example: remove the vulnerable shortcode for all roles
# Add to a mu-plugin or theme functions.php
add_action('init', function () {
    remove_shortcode('gplusnamelink');
}, 99);