CVE-2026-8887

Name of the Vulnerable Software and Affected Versions Listen Shortcode versions prior to 1.1

Description Stored Cross-Site Scripting occurs via the 'listen' shortcode. The issue stems from insufficient input sanitization and output escaping within the listenEmbedJS() function. Specifically, user-supplied attributes src, start, and end are echoed inside a single-quoted HTML attribute without proper escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Listen Shortcode to a version newer than 1.0. As a temporary mitigation, restrict user permissions to prevent users with contributor-level access from editing pages or using the 'listen' shortcode.