CVE-2026-8846

Popis

The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the -TUXQUOTE- shortcode in versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (-title-, -align-, and -width-) in the tuxquote_build_format() function, which are concatenated into the rendered HTML without being passed through esc_attr() or esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.