CVE-2026-8885: WordPress DeMomentSomTres XSS Vulnerability

CVE-2026-8885 Overview

CVE-2026-8885 is a Stored Cross-Site Scripting (XSS) vulnerability in the DeMomentSomTres Shortcodes plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.1. It resides in the st_callout() function, which processes the plugin's callout shortcode. The function concatenates the width and align shortcode attributes directly into an HTML style attribute without sufficient sanitization or output escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. The weakness is categorized as [CWE-79].

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, content tampering, and administrative action abuse.

Affected Products

DeMomentSomTres Shortcodes plugin for WordPress, versions up to and including 1.1.1
WordPress sites with contributor or higher-privilege user roles enabled
Any page containing the plugin's callout shortcode with attacker-controlled attributes

Discovery Timeline

2026-06-02 - CVE-2026-8885 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-8885

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the st_callout() function of the DeMomentSomTres Shortcodes plugin. WordPress shortcodes accept attributes that authors pass through editor content. The callout shortcode exposes width and align attributes that control layout styling. Instead of validating these attributes against expected values, such as numeric pixel widths or a fixed set of alignment keywords, the function inserts the raw attribute values into an inline HTML style attribute. An attacker can break out of the style context by injecting quote characters, closing the attribute, and adding new attributes such as event handlers. The payload persists in post content and renders whenever the page is loaded, giving the attack the persistence properties characteristic of stored XSS.

Root Cause

The root cause is insufficient input sanitization and output escaping on the width and align shortcode attributes. The plugin should constrain these attributes to known-safe character sets and apply esc_attr() before insertion into HTML. Both omissions allow attacker-supplied data to be interpreted as markup rather than as a styling string.

Attack Vector

Exploitation requires an authenticated session with contributor-level privileges or higher. A contributor creates or edits a post that uses the callout shortcode and supplies a malicious width or align value containing markup-breaking characters and a JavaScript payload. When the post is rendered, the payload executes in the visitor's browser under the site's origin. The vulnerability has a scope change, meaning the injected script runs in the security context of any user viewing the page, including administrators.

The vulnerability mechanism is documented in the WordPress Plugin Code Review Line 163 and WordPress Plugin Code Review Line 173. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-8885

Indicators of Compromise

Post or page content containing [callout] shortcodes with width or align attribute values that include quote characters, angle brackets, or on* event handler strings.
Outbound requests from visitor browsers to unfamiliar domains shortly after loading pages that include the callout shortcode.
Unexpected administrative actions, such as new user creation or plugin installation, originating from administrator sessions that recently viewed contributor-authored content.

Detection Strategies

Audit the wp_posts table for shortcode attributes containing characters not consistent with CSS length or alignment values, using SQL patterns that flag quotes, semicolons, or javascript: substrings.
Deploy a Web Application Firewall rule that inspects shortcode attribute payloads in POST requests to wp-admin/post.php and wp-admin/admin-ajax.php.
Review user role assignments and identify contributor accounts that have published or modified pages using the affected shortcode.

Monitoring Recommendations

Log and alert on all post edits performed by contributor-level accounts, particularly those introducing shortcodes with non-numeric attribute values.
Monitor browser-side error reports and Content Security Policy violation reports for inline script execution on rendered post pages.
Track plugin file integrity for demomentsomtres-shortcodes.php to detect tampering or unauthorized version changes.

How to Mitigate CVE-2026-8885

Immediate Actions Required

Disable or uninstall the DeMomentSomTres Shortcodes plugin until a patched version is available.
Review all existing posts and pages for callout shortcode usage and remove any instances containing suspicious attribute values.
Restrict contributor and author account creation, and audit existing accounts at these privilege levels for legitimacy.

Patch Information

At the time of publication, no patched version beyond 1.1.1 is referenced in the available advisory data. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org listing for an updated release that adds proper sanitization to the width and align attributes within st_callout().

Workarounds

Remove the plugin entirely and replace callout shortcode instances with native block editor equivalents or a maintained alternative.
Apply a Web Application Firewall rule that blocks requests containing callout shortcode attributes with quote characters, angle brackets, or JavaScript event handler keywords.
Reduce the privilege level of untrusted authors so they cannot publish or save posts that contain the affected shortcode.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate demomentsomtres-shortcodes
wp plugin delete demomentsomtres-shortcodes