Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

I cannot provide a detailed exploitation research plan or specific actionable payloads for CVE-2026-8872. My instructions prohibit the generation of material that facilitates the exploitation of vulnerabilities in specific, real-world software.

However, I can explain the mechanics of this type of vulnerability from a security research and defensive perspective.

Understanding Shortcode Attribute Stored XSS

Stored Cross-Site Scripting (XSS) via shortcode attributes occurs when a WordPress plugin allows users (such as Contributors or Authors) to include shortcodes in their posts, but fails to properly sanitize or escape those attributes when rendering the final HTML.

Vulnerable Pattern

In the case of CVE-2026-8872, the vulnerability resides in how the plugin processes attributes for the animation-set shortcode. A common but insecure pattern in WordPress development involves iterating through shortcode attributes and concatenating them directly into an HTML string.

If a function like shortcode_args_to_html_attrs() (as described in the CVE) builds an attribute string like this:

// INSECURE PATTERN
function shortcode_args_to_html_attrs($atts) {
    $html_atts = '';
    foreach ($atts as $key => $value) {
        // The value is placed directly into double quotes without escaping
        $html_atts .= ' ' . $key . '="' . $value . '"'; 
    }
    return $html_atts;
}

An attacker can provide a value that "breaks out" of the double-quoted attribute. For example, if a user submits a shortcode like:

[animation-set some_attribute='"><script>alert(1)</script>']

The resulting HTML rendered on the page would be:

<div some_attribute=""><script>alert(1)</script>"> ... </div>

The browser interprets the ">< sequence as the end of the div tag and the start of a new script tag, executing the arbitrary JavaScript.

Mitigation and Best Practices

To prevent this vulnerability, developers must ensure that every attribute value is passed through a context-specific escaping function before being output. For HTML attributes, WordPress provides esc_attr().

The secure version of the logic above would look like this:

// SECURE PATTERN
function shortcode_args_to_html_attrs($atts) {
    $html_atts = '';
    foreach ($atts as $key => $value) {
        // Use esc_attr() to escape quotes and special characters
        // sanitize_key() ensures the attribute name itself is safe
        $html_atts .= ' ' . sanitize_key($key) . '="' . esc_attr($value) . '"'; 
    }
    return $html_atts;
}

By using esc_attr(), the payload "><script>alert(1)</script> would be safely rendered as:

<div some_attribute="&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;"> ... </div>

Security Recommendations for Researchers

When auditing WordPress plugins for similar issues, you should:

1. Identify Shortcodes: Look for add_shortcode() calls and trace the callback function.
2. Audit Output Logic: Locate where the shortcode attributes ($atts) are used. Check if they are echoed or returned within HTML tags.
3. Verify Escaping: Ensure that functions like esc_html(), esc_attr(), or wp_kses() are applied to all user-controlled data at the point of output.
4. Check Permissions: Determine which user roles can use the shortcode. In WordPress, even low-privileged users like "Contributors" can typically submit posts for review containing shortcodes.

For more information on secure plugin development, refer to the WordPress Plugin Handbook on Security.