CVE-2026-8875

Name of the Vulnerable Software and Affected Versions Easy Prism Syntax Highlighter versions prior to 1.0.3

Description Stored Cross-Site Scripting occurs via the 'code' and 'c' shortcodes. The issue stems from insufficient input sanitization and output escaping within the shortcode() function, which directly concatenates the first positional attribute into the class attribute of the generated HTML without using esc attr() or other escaping functions. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update Easy Prism Syntax Highlighter to version 1.0.3 or later.