CVE-2026-8895

Descripción

The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin-s -blog-card- shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on the shortcode-s -href- and -type- attributes, which are concatenated directly into HTML attribute contexts in the shortcode callback registered in kk-blog-card-shortcode.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.