CVE-2026-8847

Name of the Vulnerable Software and Affected Versions Dideo plugin for WordPress version 1.0

Description Stored Cross-Site Scripting occurs via the dideo shortcode. The issue stems from insufficient input sanitization and output escaping of the id shortcode attribute, which is interpolated directly into an HTML iframe src attribute within the dideo() shortcode handler. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations As a temporary workaround, restrict the use of the id attribute within the dideo shortcode or limit user permissions to prevent contributors from editing pages until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.