CVE-2026-8886

Name of the Vulnerable Software and Affected Versions hk shortcode versions prior to 1.1

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. The issue exists in the huankong post short title plane() function when processing the 'title-plane' shortcode. Specifically, the title attribute is concatenated directly into the HTML output without proper sanitization or escaping. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary web scripts into pages, which then execute in the browser of any user who views the affected page.

Recommendations Update to a version later than 1.0. As a temporary mitigation, restrict the use of the 'title-plane' shortcode or limit user permissions to prevent contributors from editing pages containing shortcodes.