CVE-2026-8875 Overview
CVE-2026-8875 is a stored Cross-Site Scripting (XSS) vulnerability in the Easy Prism Syntax Highlighter plugin for WordPress, affecting versions up to and including 1.0.2. The flaw exists in the plugin's code and c shortcodes, where user-supplied attribute values are concatenated directly into the class attribute of generated <pre> and <code> HTML elements without escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level users can inject persistent JavaScript that executes in the browser context of every visitor, including administrators, enabling session theft and account takeover.
Affected Products
- Easy Prism Syntax Highlighter plugin for WordPress
- Versions 1.0.2 and earlier
- Vulnerable functions: shortcode handlers for code and c shortcodes
Discovery Timeline
- 2026-05-27 - CVE-2026-8875 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8875
Vulnerability Analysis
The Easy Prism Syntax Highlighter plugin registers two shortcodes, code and c, that render syntax-highlighted code blocks on WordPress pages and posts. The shortcode handler accepts a positional attribute intended to identify the programming language for Prism.js highlighting. Instead of applying WordPress's esc_attr() sanitization, the handler concatenates the attribute value directly into the rendered HTML class attribute of the <pre> and <code> tags.
An attacker can break out of the class attribute context by supplying a crafted value containing quote characters, event handler attributes, or additional HTML tags. The injected payload becomes part of the stored post content. When any visitor renders the page, the browser parses the malicious markup and executes the attacker's script under the site's origin.
Root Cause
The root cause is missing output escaping in the plugin's shortcode() function. WordPress provides esc_attr() specifically for sanitizing values placed inside HTML attributes, but the plugin omits this call when constructing the class string. See the vulnerable source at lines 116 and 123 of PrismSyntaxHighlither.php.
Attack Vector
Exploitation requires an authenticated session with contributor privileges or higher. The attacker creates or edits a post containing a [code] or [c] shortcode and supplies a malicious first positional attribute. The payload escapes the class attribute context using a quote character followed by injected attributes such as an onmouseover event handler or an injected <script> tag. Once the post is viewed, the script executes in the visitor's browser with access to cookies, the DOM, and any administrative interface the viewer is authorized to use. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-8875
Indicators of Compromise
- Post or page content containing [code] or [c] shortcodes with quote characters, angle brackets, or on* event handler strings inside attribute values
- Database entries in wp_posts.post_content referencing [code or [c followed by suspicious payload tokens such as onerror, onmouseover, or <script
- Unexpected outbound requests from admin browser sessions following page views containing the plugin's shortcodes
Detection Strategies
- Audit the wp_posts table for shortcode usage by contributor-role accounts and inspect the attribute payloads for HTML metacharacters
- Deploy a web application firewall rule that inspects POST requests to /wp-admin/post.php for shortcode attributes containing ", <, or javascript: sequences
- Use static analysis on the rendered HTML to flag <pre> and <code> elements whose class attribute contains unexpected tags or event handlers
Monitoring Recommendations
- Log and review all post creation and edit events performed by contributor and author roles
- Alert on new or modified posts that contain the easy-prism-syntax-highlighter shortcodes pending administrative approval
- Monitor browser-side errors and Content Security Policy violation reports from the WordPress front end
How to Mitigate CVE-2026-8875
Immediate Actions Required
- Disable or uninstall the Easy Prism Syntax Highlighter plugin until a patched release is available
- Review and sanitize any existing posts that use the [code] or [c] shortcodes, especially those authored by non-administrator accounts
- Restrict contributor-level account creation and audit existing contributor accounts for legitimacy
Patch Information
At the time of publication, no fixed version has been identified in the NVD record. Versions up to and including 1.0.2 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for updated release information.
Workarounds
- Remove the plugin from the WordPress installation and replace it with an alternative syntax highlighter that escapes attribute output
- Apply a custom shortcode filter that wraps the plugin's output in esc_attr() for the language parameter before rendering
- Enforce a strict Content Security Policy that disallows inline scripts and event handler attributes on the front end
- Limit shortcode usage to trusted roles by overriding the plugin's shortcode registration with a capability check
# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate easy-prism-syntax-highlighter
wp plugin delete easy-prism-syntax-highlighter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
