CVE-2026-8846 Overview
CVE-2026-8846 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tuxquote plugin for WordPress, affecting all versions up to and including 1.3. The flaw resides in the tuxquote_build_format() function, which processes the TUXQUOTE shortcode. User-supplied attributes (title, align, and width) are concatenated into rendered HTML without sanitization or output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The issue is classified under CWE-79.
Critical Impact
Authenticated Contributor-level attackers can persist arbitrary JavaScript in published pages, enabling session theft, administrative account takeover, and arbitrary redirection of site visitors.
Affected Products
- Tuxquote plugin for WordPress — versions up to and including 1.3
- WordPress sites permitting Contributor or higher user registration
- Any site rendering posts that embed the TUXQUOTE shortcode
Discovery Timeline
- 2026-05-27 - CVE-2026-8846 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8846
Vulnerability Analysis
The vulnerability resides in the tuxquote_build_format() function inside tuxquote.php. WordPress shortcodes accept attribute arguments parsed via shortcode_atts(), which returns raw user-supplied values. The Tuxquote plugin concatenates these values directly into HTML output. Three attributes are affected: title, align, and width.
Because the plugin does not pass these attributes through esc_attr() or esc_html() before rendering, an attacker can break out of attribute context using quote characters and inject script tags or event handlers. The injected payload is stored in the post content and executes whenever the page is rendered to any visitor, including administrators.
The attack requires authentication at the Contributor role or above. Contributors can author posts containing shortcodes in WordPress by default, which is sufficient to weaponize the flaw. Once an administrator previews or publishes content embedding the malicious shortcode, the payload runs in a privileged session.
Root Cause
The root cause is missing input sanitization and output escaping on shortcode attributes. WordPress provides esc_attr() for attribute context and esc_html() for text context, but neither is applied in the vulnerable code paths at lines 81 and 91 of tuxquote.php in version 1.3.
Attack Vector
An attacker authenticates as a Contributor, creates a post containing a [TUXQUOTE] shortcode, and supplies a malicious title, align, or width attribute that escapes the HTML attribute quoting. When the post is rendered, the injected script executes in the viewer's browser under the site's origin.
No verified exploit code is publicly available. See the Wordfence Vulnerability Report and the WordPress Plugin Code Review at line 81 for technical details.
Detection Methods for CVE-2026-8846
Indicators of Compromise
- Posts or pages containing [TUXQUOTE] shortcodes with attribute values that include <script>, onerror=, onload=, javascript:, or unbalanced quote characters.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts that embed the Tuxquote shortcode.
- Newly created Contributor accounts followed by post drafts referencing the Tuxquote shortcode.
Detection Strategies
- Query the wp_posts table for post_content containing [TUXQUOTE combined with HTML metacharacters such as <, >, or ".
- Review WordPress audit logs for post edits performed by Contributor accounts that introduce shortcode usage.
- Inspect rendered page HTML for script tags or event handlers within elements generated by the Tuxquote plugin.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture post creation and revision events by lower-privileged roles.
- Monitor web server access logs for anomalous referrers and outbound JavaScript beacon traffic from admin session IPs.
- Alert on creation of new administrator accounts or modifications to user roles following any Contributor post publication.
How to Mitigate CVE-2026-8846
Immediate Actions Required
- Deactivate and remove the Tuxquote plugin until a patched version is released by the maintainer.
- Audit all existing posts and pages for the [TUXQUOTE] shortcode and inspect attribute values for script payloads.
- Restrict Contributor and Author registration on sites that do not require open authorship.
- Rotate administrator session cookies and credentials if suspicious shortcode content is found.
Patch Information
At the time of publication, no fixed version of the Tuxquote plugin has been identified in the NVD record. Monitor the WordPress plugin repository and the Wordfence Vulnerability Report for an updated release that applies esc_attr() to the title, align, and width attributes in tuxquote_build_format().
Workarounds
- Remove the plugin entirely if a patched version is unavailable, since the vulnerable code path activates whenever the shortcode renders.
- Enforce the principle of least privilege by demoting unused Contributor accounts and requiring editorial review before publication.
- Deploy a web application firewall rule that blocks shortcode attribute values containing <, >, or quote characters in POST requests to /wp-admin/post.php.
# Disable the Tuxquote plugin via WP-CLI
wp plugin deactivate tuxquote
wp plugin delete tuxquote
# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[TUXQUOTE%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
