CVE-2026-8872

Name of the Vulnerable Software and Affected Versions Animate Your Content versions prior to 1.0.1

Description Stored Cross-Site Scripting occurs via the 'animation-set' shortcode. The issue stems from insufficient input sanitization and output escaping within the shortcode args to html attrs() function, which concatenates attribute values directly into HTML attributes without using esc attr(). Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update Animate Your Content to version 1.0.1 or later.