CVE-2026-8877 Overview
The Responsive Video Embedder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the rem_video shortcode. The flaw affects all versions up to and including 0.1. The video_shortcode() function concatenates user-supplied id and list attributes directly into an HTML iframe src attribute without sanitization or output escaping. Authenticated attackers holding contributor-level privileges or higher can inject arbitrary JavaScript that executes when any user views the affected page. The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79].
Critical Impact
Contributor-level WordPress users can inject persistent JavaScript that executes in the browsers of administrators and site visitors, enabling session theft and administrative account takeover.
Affected Products
- Responsive Video Embedder plugin for WordPress, versions 0.1 and earlier
- WordPress sites with contributor-level or higher user registration enabled
- WordPress installations using the vulnerable rem_video shortcode
Discovery Timeline
- 2026-05-27 - CVE-2026-8877 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8877
Vulnerability Analysis
The Responsive Video Embedder plugin exposes the rem_video shortcode for embedding videos in WordPress content. The video_shortcode() function accepts user-controlled attributes including id and list. These attributes are inserted directly into the src attribute of an HTML <iframe> element returned to the browser.
The function performs no input sanitization on the incoming attribute values. It also omits output escaping such as esc_attr() before constructing the iframe markup. An attacker can break out of the src attribute context by supplying values containing quote characters and inject arbitrary HTML attributes or JavaScript event handlers.
The payload persists in the WordPress database as part of the post or page content. The script executes in the browser session of every subsequent visitor, including administrators reviewing contributor submissions.
Root Cause
The root cause is missing input validation combined with absent output encoding in the video_shortcode() handler. WordPress provides built-in escaping functions such as esc_attr() and esc_url() for attribute contexts, but the plugin does not invoke them when handling the id and list parameters before rendering the iframe.
Attack Vector
An authenticated attacker with contributor privileges creates a post containing the rem_video shortcode with a malicious id or list attribute. The crafted attribute closes the iframe src quote and appends an event handler such as onerror or onload carrying a JavaScript payload. When an editor previews the submission or a visitor loads the published page, the injected script runs in their browser context. The attacker can steal authentication cookies, perform actions as the victim, or pivot to administrative account compromise.
The vulnerability mechanism is described in the Wordfence Vulnerability Report and the affected code is visible in the WordPress Plugin Code Reference.
Detection Methods for CVE-2026-8877
Indicators of Compromise
- Posts or pages containing the rem_video shortcode with attribute values that include quote characters, angle brackets, or javascript: strings
- Database entries in wp_posts where post_content contains rem_video alongside HTML event handlers such as onerror=, onload=, or onmouseover=
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after viewing contributor content
- New WordPress administrator accounts or modified user roles following contributor post submissions
Detection Strategies
- Scan post and page content for the rem_video shortcode and inspect the id and list attribute values for non-alphanumeric characters
- Audit the WordPress wp_posts table with SQL queries searching for shortcode payloads containing suspicious script syntax
- Deploy a Web Application Firewall (WAF) rule that inspects shortcode attribute values for HTML escape sequences
Monitoring Recommendations
- Log all contributor-submitted content for manual review before publication
- Monitor WordPress user role changes and unexpected administrator account creation
- Alert on Content Security Policy (CSP) violations indicating inline script execution from post pages
How to Mitigate CVE-2026-8877
Immediate Actions Required
- Disable or remove the Responsive Video Embedder plugin until a patched version is available
- Audit existing posts and pages for use of the rem_video shortcode and remove any suspicious content
- Restrict contributor account creation and review existing low-privilege accounts for unauthorized additions
- Reset administrator session cookies and rotate credentials if contributor accounts are present on the site
Patch Information
No vendor patch is referenced in the available advisory data at the time of publication. Administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for fix availability.
Workarounds
- Deactivate the Responsive Video Embedder plugin entirely
- Apply a Content Security Policy that disallows inline scripts and restricts iframe sources to trusted domains
- Limit the WordPress contributor role to trusted users and require editorial approval before publishing
- Deploy a WAF rule that blocks rem_video shortcode submissions containing quote or angle-bracket characters in attributes
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate responsive-video-embedder
wp plugin delete responsive-video-embedder
# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[rem_video%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
