CVE-2026-8867

Description

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (such as total_width, color_scheme, and caption_font_size) inside the sc_horcatbar() function, which are concatenated directly into HTML attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/f439718e-4a3d-4dc9-a16c-6b655480dde6?source=cve
• https://plugins.trac.wordpress.org/browser/post-category-gallery/trunk/horcatbar.php#L97
• https://plugins.trac.wordpress.org/browser/post-category-gallery/trunk/horcatbar.php#L79

CWEs

CWE-79

💬 Discuss CVE-2026-8867 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.