CVE-2026-8895

Name of the Vulnerable Software and Affected Versions kk blog card versions prior to 1.4

Description The kk blog card plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the plugin fails to properly sanitize input and escape output for the href and type attributes within the 'blog-card' shortcode. These attributes are concatenated directly into HTML attribute contexts in the shortcode callback registered in kk-blog-card-shortcode.php. Consequently, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update to a version later than 1.3.