CVE-2026-8896

Name of the Vulnerable Software and Affected Versions MIR blocks and shortcodes versions prior to 1.0.1

Description The MIR blocks and shortcodes plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping of user-supplied shortcode attributes within the msc stats() rendering function. The affected attributes include title and ready animation text of the 'msc stats' shortcode.

Recommendations Update the plugin to a version later than 1.0.0. As a temporary workaround, restrict the use of the title and ready animation text attributes within the 'msc stats' shortcode.