CVE-2026-8884

The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level user can trigger execution against higher-privileged users by embedding the malicious shortcode in a post submitted for review, causing the injected scripts to execute when an administrator previews or views the post.

• CWE-79

• https://plugins.trac.wordpress.org/browser/iq-quotation-page/trunk/IQ-quotation-page.php#L339
• https://plugins.trac.wordpress.org/browser/iq-quotation-page/trunk/IQ-quotation-page.php#L429
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f7140053-a3c3-44c4-bc83-2e9b9e8853d6?source=cve

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88830A unit confusion in BusyBox TLS Montgomery reduction buffer …7.5
• CVE-2026-88831BusyBox httpd IP deny rules with invalid CIDR prefix lengths…5.3
• CVE-2026-88832BusyBox romfs volume ID parsing uses unbounded strlen on att…7.3
• CVE-2026-88835BusyBox dpkg read_package_field() steps past a NUL terminato…6.1
• CVE-2026-88837BusyBox httpd treats yescrypt ($y$) password hashes as plain…6.5
• CVE-2026-88839BusyBox passwd/group tokenize() references a stale endpoint …6.7
• CVE-2026-88840BusyBox TLS get_client_hello() reads past the end of the inp…5.3
• CVE-2026-88843The MasterStudy LMS WordPress Plugin WordPress plugin befor…7.2
• CVE-2026-88844The MasterStudy LMS WordPress Plugin WordPress plugin befor…2.7
• CVE-2026-88845The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3
• CVE-2026-88846The MasterStudy LMS WordPress Plugin WordPress plugin befor…5.3
• CVE-2026-88847The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3