CVE-2026-8701

Name of the Vulnerable Software and Affected Versions GNTT Post Title Ticker version 1.0

Description Stored Cross-Site Scripting occurs via the title-ticker-slide, title-ticker-fade, and title-ticker-typing shortcodes. The issue stems from insufficient input sanitization and output escaping of shortcode attributes, specifically border, width, height, header background, header text color, and id, within the gntt title ticker slide(), gntt title ticker fade(), and gntt title ticker typing() functions. Because these attribute values are not processed through esc attr() or similar escaping functions before being concatenated into HTML output, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.