CVE-2026-8883

Name of the Vulnerable Software and Affected Versions Global Body Mass Index Calculator versions prior to 1.3

Description The Global Body Mass Index Calculator plugin for WordPress contains a Stored Cross-Site Scripting issue. The GBMI Calc Widget::widget() function fails to properly sanitize input and escape output for user-supplied shortcode attributes within the 'gbmicalc' shortcode. Specifically, attributes are extracted into local variables using @extract($args) and echoed unescaped into HTML body contexts (title) and HTML style attributes (height/width), enabling attribute-breakout payloads. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.2.