PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8702 garber CVE debrief

## Summary Stored Cross-Site Scripting (XSS) vulnerability in the GBI To Print WordPress plugin version 1.0, allowing authenticated contributors and above to inject arbitrary JavaScript via the 'div' shortcode attribute. ## Technical Details The vulnerability exists in the `gbi_toprint_shortcode()` function, which fails to apply `esc_attr()` or equivalent sanitization when outputting the 'div' shortcode attribute value directly into HTML. This permits injection of malicious scripts that execute when any user visits a page containing the crafted shortcode. ## Affected Product - **Product:** GBI To Print WordPress plugin - **Version:** 1.0 - **Vendor:** Unknown (identified via WordPress reference domain) ## CVSS Assessment - **Score:** 6.4 (MEDIUM) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - **Attack Vector:** Network - **Attack Complexity:** Low - **Privileges Required:** Low (Contributor+) - **User Interaction:** None - **Scope:** Changed - **Impact:** Confidentiality Low, Integrity Low, Availability None ## Exploitation Requirements - **Authentication:** Required (Contributor-level or higher) - **User Interaction:** None required for execution (victim simply visits injected page) ## Defensive Recommendations 1. **Immediate:** Disable or remove the GBI To Print plugin until a patched version is available 2. **Code Review:** Audit all shortcode handlers for proper output escaping using `esc_attr()`, `esc_html()`, or `wp_kses()` 3. **Input Validation:** Implement strict allowlisting for shortcode attributes 4. **Monitoring:** Review existing content for unauthorized `[gbitoprint]` shortcode usage 5. **Principle of Least Privilege:** Restrict contributor access where unnecessary ## Timeline - **CVE Published:** 2026-05-27 - **Source Published:** 2026-05-27 - **Status:** Received (NVD) ## References - CVE Record: CVE.org - NVD Entry: NVD - Wordfence Advisory: Wordfence Threat Intelligence - Source Code Reference: WordPress Plugin Trac

Vendor
garber
Product
GBI To Print
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators, security teams managing WordPress installations, developers maintaining custom shortcode implementations

Technical summary

Insufficient output escaping in gbi_toprint_shortcode() function allows authenticated contributors to inject JavaScript via the 'div' attribute of the [gbitoprint] shortcode. The raw attribute value is concatenated directly into HTML without esc_attr() sanitization, resulting in stored XSS execution on page view.

Defensive priority

medium

Recommended defensive actions

  • Disable GBI To Print plugin pending security update
  • Audit WordPress content for unauthorized [gbitoprint] shortcode usage
  • Review all custom shortcode implementations for proper output escaping
  • Apply principle of least privilege for WordPress user roles
  • Monitor for plugin security updates via WordPress admin dashboard

Evidence notes

Vulnerability confirmed via Wordfence security advisory and plugin source code review. CWE-79 (Improper Neutralization of Input During Web Page Generation) classified as primary weakness. No known exploitation in the wild or KEV listing at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8702 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8702

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8702 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8702

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.