CVE-2026-8869

Name of the Vulnerable Software and Affected Versions Mutual Funds Data plugin for WordPress versions prior to 1.2.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the title shortcode attribute within the mfd shortcode() function. The attribute is concatenated directly into the HTML output inside a element, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user views the affected page.

Recommendations Update the plugin to a version newer than 1.2.1. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or use the title attribute in shortcodes.