CVE-2026-8844

Name of the Vulnerable Software and Affected Versions Responsive Check versions prior to 0.0.4

Description Stored Cross-Site Scripting occurs via the 'rspcheck' shortcode. The issue stems from insufficient input sanitization and output escaping within the rspc check shortcode() function. Specifically, the url and button shortcode attributes are echoed directly into iframe src attributes without using esc attr() or esc url(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 0.0.3. As a temporary mitigation, restrict the use of the 'rspcheck' shortcode or limit user permissions to prevent contributors from editing pages.