https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 15:05:01 +0000 https://db.gcve.eu/vuln/cve-2026-8886 <p><strong>Affected:</strong> huankong hk_shortcode</p> <p>The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title-plane&#39; shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankong_post_short_title_plane() function, where the &#39;title&#39; attribute is concatenated directly into HTML output without any escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p><strong>Affected:</strong> huankong hk_shortcode</p> <p>The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title-plane&#39; shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankong_post_short_title_plane() function, where the &#39;title&#39; attribute is concatenated directly into HTML output without any escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://db.gcve.eu/vuln/cve-2026-8886