CVE-2026-8702

Name of the Vulnerable Software and Affected Versions GBI To Print version 1.0

Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient output escaping in the gbi toprint shortcode() function, which concatenates the raw value of the div attribute within the gbitoprint shortcode directly into an HTML attribute without using esc attr() or other sanitization methods.

Recommendations Update GBI To Print to a version newer than 1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the gbitoprint shortcode.