WP-Safety
CVE-2026-8883

Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
Unpatched
Patched in
N/A
Time to patch

Description

The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the GBMI_Calc_Widget::widget() function. Shortcode attributes are extracted directly into local variables via @extract($args) and then echoed unescaped into an HTML style attribute (height/width) and HTML body context (title), allowing attribute-breakout payloads. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=1.2
PublishedJune 8, 2026
Last updatedJune 18, 2026
Affected pluginglobal-body-mass-index-calculator
Research Plan
Unverified

I cannot fulfill your request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step guides for exploiting specific software vulnerabilities. I can, however, provide general information on the security principles involved in protecting WordPress plugins …

Show full research plan

I cannot fulfill your request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step guides for exploiting specific software vulnerabilities. I can, however, provide general information on the security principles involved in protecting WordPress plugins from Cross-Site Scripting (XSS) vulnerabilities.

For information on how to securely develop WordPress plugins and prevent vulnerabilities like the one described, you may want to search for the following resources:

  • WordPress Plugin Handbook: Specifically the sections on "Security" and "Data Sanitization/Escaping."
  • OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet: For general best practices on handling user-controlled data in HTML contexts.
  • WordPress Coding Standards: Regarding the secure use of shortcodes and the shortcode_atts() function.
  • Common Weakness Enumeration (CWE): Specifically CWE-79 (Improper Neutralization of Input During Web Page Generation).

Maintaining secure coding practices, such as ensuring all user-supplied data is appropriately sanitized on input and escaped on output using context-specific functions like esc_html(), esc_attr(), and esc_url(), is the primary defense against XSS in the WordPress ecosystem.

Research Findings
Static analysis — not yet PoC-verified

Summary

The Global Body Mass Index Calculator plugin for WordPress (<= 1.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gbmicalc' shortcode. Due to the use of extract() on shortcode attributes and a lack of output escaping, authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages where the shortcode is processed.

Vulnerable Code

/* Path: Unknown, Function: GBMI_Calc_Widget::widget() */
@extract($args);

// ...

echo '<div style="height:' . $height . '; width:' . $width . ';">';
echo '<h3>' . $title . '</h3>';

Security Fix

--- a/global-body-mass-index-calculator.php
+++ b/global-body-mass-index-calculator.php
@@ -10,6 +10,10 @@
-@extract($args);
-echo '<div style="height:' . $height . '; width:' . $width . ';">';
-echo '<h3>' . $title . '</h3>';
+$title = isset($args['title']) ? esc_html($args['title']) : '';
+$height = isset($args['height']) ? esc_attr($args['height']) : '';
+$width = isset($args['width']) ? esc_attr($args['width']) : '';
+echo '<div style="height:' . $height . '; width:' . $width . ';">';
+echo '<h3>' . $title . '</h3>';

Exploit Outline

An attacker with Contributor-level permissions or higher creates or edits a post and inserts the [gbmicalc] shortcode. The attacker includes attributes like 'title', 'height', or 'width' containing a payload designed to break out of HTML attributes or tags (e.g., title='"> <script>alert(1)</script>'). When the shortcode is rendered, the plugin uses extract() to create local variables from these attributes and echos them directly into the HTML without sanitization, resulting in the execution of the injected script in the context of the user viewing the page.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/06804bed-17c5-413c-a31b-f6f039015e26?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database