CVE-2026-8883 Overview
CVE-2026-8883 is a Stored Cross-Site Scripting (XSS) vulnerability in the Global Body Mass Index Calculator plugin for WordPress, affecting versions up to and including 1.2. The flaw resides in the gbmicalc shortcode handler within the GBMI_Calc_Widget::widget() function. Shortcode attributes are passed through @extract($args) and echoed without sanitization into HTML style attributes and the body context. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when users view the affected page. The issue is tracked under CWE-79.
Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes in the browsers of all visitors, including administrators, enabling session theft and account compromise.
Affected Products
- Global Body Mass Index Calculator plugin for WordPress
- All versions up to and including 1.2
- WordPress sites with the plugin installed and contributor-or-higher accounts enabled
Discovery Timeline
- 2026-06-09 - CVE-2026-8883 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-8883
Vulnerability Analysis
The vulnerability stems from unsafe handling of user-controlled shortcode attributes in the gbmicalc shortcode. When a contributor embeds the shortcode in a post or page, the supplied attributes are passed to GBMI_Calc_Widget::widget(). The function uses @extract($args) to convert array keys into local PHP variables, then outputs the height, width, and title values directly into the rendered HTML.
The height and width values land inside an HTML style attribute, while title is echoed into the HTML body. Because no sanitization or output escaping is applied, an attacker can supply attribute values containing quote characters to break out of the style attribute and inject event handlers such as onmouseover or onload. The injected script persists in the post content and executes for every user who loads the page.
Root Cause
The root cause is missing input sanitization combined with missing output escaping. The plugin should call WordPress hardening functions such as esc_attr() for attribute contexts and esc_html() for body contexts. Instead, raw attribute values are concatenated into the HTML response. The use of @extract($args) further obscures the data flow and silences PHP errors that might otherwise reveal the issue.
Attack Vector
Exploitation requires an authenticated session with contributor privileges or above. The attacker creates or edits a post containing the gbmicalc shortcode with malicious attribute values. The payload breaks out of the surrounding style attribute by injecting a closing quote followed by an event handler. When any visitor, including an administrator, views the post, the script executes in their browser context. Successful exploitation enables session token theft, forced administrative actions through CSRF, or redirection to attacker-controlled infrastructure.
Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable code paths.
Detection Methods for CVE-2026-8883
Indicators of Compromise
- Posts or pages containing [gbmicalc] shortcodes with attribute values that include quote characters, angle brackets, or on* event handler names
- Unexpected <script> tags, javascript: URIs, or inline event handlers appearing in rendered post HTML
- Outbound browser requests from site visitors to unfamiliar domains immediately after loading plugin-rendered pages
- New or modified posts authored by contributor accounts that embed BMI calculator shortcodes
Detection Strategies
- Review the wp_posts table for post_content entries containing gbmicalc shortcode usage with suspicious attribute values
- Monitor web server access logs for requests to posts that contain the shortcode and correlate with unusual Referer or response sizes
- Apply web application firewall rules that flag shortcode attributes containing quote-breakout sequences such as `
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
