CVE-2026-8867: WordPress Post Category Gallery XSS Flaw

CVE-2026-8867 Overview

CVE-2026-8867 is a Stored Cross-Site Scripting (XSS) vulnerability in the Post Category Gallery plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw resides in the sc_horcatbar() function, which processes the postcategorygallery shortcode. User-supplied shortcode attributes — including total_width, color_scheme, and caption_font_size — are concatenated directly into HTML attribute values without sufficient sanitization or output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user views the affected page. The issue is tracked under [CWE-79].

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browsers of all subsequent page visitors, enabling session theft, redirection, and content tampering.

Affected Products

WordPress Post Category Gallery plugin versions ≤ 1.0.0
Vulnerable file: horcatbar.php
Affected function: sc_horcatbar() handling the postcategorygallery shortcode

Discovery Timeline

2026-05-27 - CVE-2026-8867 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8867

Vulnerability Analysis

The vulnerability is a stored XSS issue caused by missing input sanitization and output escaping inside the sc_horcatbar() function of the Post Category Gallery plugin. When a post or page containing the postcategorygallery shortcode is rendered, the plugin reads attributes such as total_width, color_scheme, and caption_font_size from the shortcode and concatenates them directly into the resulting HTML attribute values. Because the values are not validated against expected types (numeric width, color, font size) and are not escaped through functions such as esc_attr(), an attacker can break out of the HTML attribute context and inject event handlers or <script> payloads. The payload is stored in the post content and executes for every visitor who loads the page.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin trusts shortcode attributes supplied by post authors and inserts them into HTML without escaping. Contributor-level WordPress users can submit posts containing arbitrary shortcode attributes, so the trust boundary between authenticated authors and rendered output is violated. Code locations are documented at horcatbar.php line 79 and horcatbar.php line 97.

Attack Vector

An attacker first obtains contributor-level credentials on the target WordPress site. They then create or edit a post that includes the postcategorygallery shortcode, supplying a crafted value for total_width, color_scheme, or caption_font_size that closes the surrounding HTML attribute and injects an event handler or script tag. When the post is previewed or published and viewed by any user — including administrators — the injected script executes in their browser session. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-8867

Indicators of Compromise

Posts or pages containing the postcategorygallery shortcode with attribute values that include quotes, angle brackets, javascript:, onerror=, onload=, or <script> fragments
Unexpected outbound requests from visitor browsers to attacker-controlled domains immediately after rendering affected pages
Newly created contributor or author accounts followed by edits to posts using the vulnerable shortcode

Detection Strategies

Query the wp_posts table for post_content containing postcategorygallery and inspect attribute values for non-alphanumeric characters
Review web server access logs for suspicious GET requests to posts containing the shortcode shortly after creation or modification
Monitor WordPress audit logs for contributor-level accounts publishing or editing content that uses the affected shortcode

Monitoring Recommendations

Enable a web application firewall ruleset that inspects shortcode attribute payloads for XSS sequences
Alert on creation of WordPress accounts with contributor or higher roles, and on the first post each new account submits
Track Content Security Policy (CSP) violation reports for inline script execution on pages that should not contain scripts

How to Mitigate CVE-2026-8867

Immediate Actions Required

Deactivate the Post Category Gallery plugin until a patched release is available
Audit all existing posts for the postcategorygallery shortcode and remove or sanitize any suspicious attribute values
Restrict contributor-level account creation and review existing low-privilege accounts for legitimacy

Patch Information

No fixed version is identified in the published advisory at the time of writing. All versions up to and including 1.0.0 remain vulnerable. Site administrators should monitor the Wordfence advisory and the plugin source repository for an updated release that applies esc_attr() or equivalent escaping to shortcode attributes.

Workarounds

Remove the plugin from the WordPress installation if it is not business-critical
Restrict the unfiltered_html capability and limit contributor accounts to trusted users only
Deploy a Content Security Policy that disallows inline scripts and unauthorized external script sources to limit XSS impact
Use a WordPress security plugin or WAF rule to block shortcode attribute values containing HTML metacharacters

bash

# Example: locate posts using the vulnerable shortcode via WP-CLI
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[postcategorygallery%' AND post_status IN ('publish','draft','pending');"

# Temporarily deactivate the plugin until a patched version is released
wp plugin deactivate post-category-gallery