PT-2026-45710 · WordPress · Demomentsomtres Shortcodes

Zakaria · CVE-2026-8885 · Published 2026-06-02 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DeMomentSomTres Shortcodes versions prior to 1.1.2

Description The DeMomentSomTres Shortcodes plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the st callout() function fails to properly sanitize input and escape output for the width and align attributes of the 'callout' shortcode, concatenating these values directly into an HTML style attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update to a version later than 1.1.1. As a temporary workaround, restrict the use of the 'callout' shortcode or limit the width and align attributes until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8885

Affected Products

Demomentsomtres Shortcodes

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-8885 · Security Note
• https://twitter.com/VulmonFeeds/status/2061759593777143814 · Twitter Post
• https://plugins.trac.wordpress.org/browser/demomentsomtres-shortcodes/trunk/demomentsomtres-shortcodes.php#L163 · Note
• https://twitter.com/atomicedgeWAF/status/2062040522571575748 · Twitter Post
• https://t.me/CVEtracker/55576 · Telegram Post
• https://reddit.com/r/StopBadBots/comments/1u38lfq/25_unpatched_wordpress_plugins_remove_them_today · Reddit Post
• https://plugins.trac.wordpress.org/browser/demomentsomtres-shortcodes/trunk/demomentsomtres-shortcodes.php#L173 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8f09f239-dd6e-4fc0-b656-f8c73b7e9022?source=cve · Note