CVE-2026-8885: DeMomentSomTres Shortcodes WordPress Plugin Stored XSS Vulnerability

Technical summary

The vulnerability resides in the st_callout() function within the DeMomentSomTres Shortcodes plugin (versions up to 1.1.1). The function concatenates the 'width' and 'align' shortcode attributes directly into HTML style attributes without sanitization or escaping. An authenticated attacker with contributor access or above can craft a malicious shortcode containing JavaScript that will be stored in the page content and executed in the browser context of any user viewing that page. The CVSS 3.1 score of 6.4 (Medium) reflects network accessibility, low attack complexity, and the requirement for authentication, balanced against limited confidentiality and integrity impact with no availability impact.

Business impact

Sites using this plugin are exposed to session hijacking, credential theft, malware distribution, and defacement via stored XSS. Since the attack requires only contributor-level access, any editor or author on the site becomes a potential attack vector—either through compromised credentials or insider threat. The persistent nature means malicious code remains active until manually removed, potentially affecting all site visitors during that window. For multi-user WordPress installations, this significantly expands the attack surface.

Affected systems

Any WordPress installation running DeMomentSomTres Shortcodes plugin version 1.1.1 or earlier is affected. The vulnerability requires authentication and contributor-level or higher role assignment, so it does not affect sites where contributor access is tightly restricted. Public and private WordPress networks are equally at risk if the plugin is installed.

Exploitability

Exploitation requires valid WordPress user credentials with contributor-level permissions or above. An attacker must already have or obtain authenticated access to the WordPress admin panel. While this requirement raises the barrier compared to unauthenticated exploits, many WordPress sites operate with looser credential management or multiple editors, making this a practical threat. No special tools or techniques are needed; a basic understanding of WordPress shortcodes and HTML/JavaScript suffices. The CVSS vector reflects this by assigning a Low privilege requirement impact, not None.

Remediation

Update the DeMomentSomTres Shortcodes plugin immediately to a patched version beyond 1.1.1 once available, or disable and remove the plugin if no patch is forthcoming. In the interim, restrict contributor-level access to trusted users only, and audit existing pages for suspicious 'callout' shortcodes. Consider using a Web Application Firewall (WAF) rule to detect and block inline script injection in shortcode parameters.

Patch guidance

Verify against the official DeMomentSomTres plugin repository or vendor advisory for the release date and version number of the patch addressing this vulnerability. Apply the update as soon as it becomes available. If you manage a hosted WordPress environment, prioritize this update in your patching schedule due to the stored XSS persistence. Test the update in a staging environment before deploying to production to ensure compatibility with existing shortcodes and site functionality.

Detection guidance

Audit your WordPress database for 'callout' shortcodes containing suspicious 'width' or 'align' attribute values, particularly those that include script tags, event handlers (onclick, onerror, onload), or encoded JavaScript. WordPress security plugins that scan post content for XSS patterns can help identify compromised pages. Monitor user activity logs for unusual shortcode edits by contributor-level accounts, and enable logging on sensitive content revisions. Check site visitor browser logs for unexpected console errors or blocked script warnings.

Why prioritize this

Although the CVSS score is Medium (6.4), this vulnerability merits priority attention because stored XSS directly endangers all site visitors, not just administrators. The attack persists until remediated, and the barrier to entry—authenticated contributor access—is present on most multi-user WordPress sites. Organizations managing WordPress installations with multiple editors should prioritize patching to prevent credential compromise or insider abuse. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a perennial attack vector.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects: Network-based attack vector (accessible remotely), low attack complexity (no special conditions), requirement for authentication (not exploitable by unauthenticated users), and scope change (the injected script affects other users, not just the attacker's session). The Low confidentiality and integrity impact assumes the attacker cannot directly access or modify sensitive data but can view or alter page content visible to others. The score does not account for organizational context—sites with strict role management face lower practical risk than those with permissive contributor access.

Frequently asked questions