CVE-2026-8895: kk Blog Card WordPress Plugin XSS Flaw

CVE-2026-8895 Overview

CVE-2026-8895 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the kk blog card plugin for WordPress in all versions up to and including 1.3. The flaw resides in the plugin's blog-card shortcode handler in kk-blog-card-shortcode.php, where the href and type attributes are concatenated directly into HTML attribute contexts without proper sanitization or output escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when an affected page is rendered.

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and visitor-side attacks against anyone viewing the compromised content.

Affected Products

WordPress plugin: kk blog card
All versions up to and including 1.3
Vulnerable file: kk-blog-card-shortcode.php

Discovery Timeline

2026-06-09 - CVE-2026-8895 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8895

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting issue in the WordPress kk blog card plugin. The plugin registers a blog-card shortcode whose callback function reads user-supplied href and type attributes and writes them directly into the rendered HTML. Because these values are concatenated into attribute contexts without applying WordPress escaping functions such as esc_url() or esc_attr(), an attacker can break out of the attribute context and inject script-bearing HTML.

The injected payload is stored in post or page content as part of the shortcode arguments. When any visitor or administrator views the affected page, the browser parses the malicious attribute and executes the attacker's JavaScript in the site's origin. This grants the attacker access to session cookies, the WordPress REST API, and any administrative UI rendered in the victim's browser.

Exploitation requires contributor-level privileges, which lowers the barrier on sites that allow user registration or guest authoring. The scope is changed because script executing in an administrator's session can pivot to higher-impact actions, including plugin installation and account creation.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on the href and type shortcode attributes in kk-blog-card-shortcode.php. The shortcode callback trusts the attribute values supplied by post authors and writes them into HTML without calling WordPress escaping helpers appropriate for attribute and URL contexts.

Attack Vector

An attacker with contributor or higher privileges creates or edits a post containing the blog-card shortcode with a crafted href or type attribute. The payload breaks out of the attribute quoting and injects an event handler or script element. When the post is previewed, published, or viewed by any user, the script executes in the visitor's browser context. Technical details and the vulnerable source lines are documented in the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-8895

Indicators of Compromise

Posts or pages containing [blog-card] shortcodes with href or type attribute values containing quote characters, angle brackets, javascript: URIs, or on* event handler names.
Unexpected outbound requests from visitor browsers to attacker-controlled domains shortly after viewing pages with embedded blog cards.
New administrator accounts or modified user roles created shortly after a contributor edits a post containing the blog-card shortcode.

Detection Strategies

Query the wp_posts table for post_content values matching blog-card shortcodes and review the href and type attributes for suspicious characters.
Enable a Content Security Policy in report-only mode and monitor violations triggered by inline script execution on pages rendered by the plugin.
Audit WordPress activity logs for contributor accounts editing or publishing posts that include the blog-card shortcode.

Monitoring Recommendations

Monitor web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts.
Alert on anomalous JavaScript execution patterns from WordPress page views, such as requests to external script hosts not referenced by themes or plugins.
Track new user registrations with contributor or higher roles on sites that use the kk blog card plugin.

How to Mitigate CVE-2026-8895

Immediate Actions Required

Deactivate and remove the kk blog card plugin until a patched version is available, since no fixed release is referenced for versions above 1.3.
Audit all posts and pages containing the blog-card shortcode and remove any entries with suspicious href or type attribute values.
Restrict contributor and author account creation, and rotate credentials for any accounts that may have been used to inject payloads.

Patch Information

At the time of publication, no patched version above 1.3 is referenced in the NVD entry or the Wordfence Vulnerability Report. Site operators should monitor the plugin's WordPress.org page for a security release and apply it as soon as it becomes available.

Workarounds

Remove or disable the kk blog card plugin and replace it with a maintained alternative that properly escapes shortcode attributes.
Reduce the attack surface by limiting which users can publish posts and by disabling the unfiltered_html capability for all non-administrator roles.
Deploy a web application firewall rule that blocks blog-card shortcode submissions containing quote characters, angle brackets, or javascript: schemes in the href or type attributes.

bash

# Configuration example: disable the vulnerable plugin from the WordPress CLI
wp plugin deactivate kk-blog-card
wp plugin delete kk-blog-card

# Search existing content for the vulnerable shortcode for manual review
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[blog-card%';"