CVE-2026-8842

Name of the Vulnerable Software and Affected Versions Google+ Link Name plugin for WordPress versions prior to 1.1

Description Stored Cross-Site Scripting occurs via the gplusnamelink shortcode. The issue stems from insufficient input sanitization and output escaping within the gplusnamelink generate() function. Specifically, the id and name variables are concatenated directly into the rendered HTML without using esc attr() or esc html(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.0. As a temporary mitigation, restrict user permissions to prevent users with contributor-level access from editing pages or using the gplusnamelink shortcode.