PatchSiren cyber security CVE debrief
CVE-2026-8842 morettolss CVE debrief
The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gplusnamelink' shortcode in versions up to and including 1.0. The vulnerability exists in the gplusnamelink_generate() function, where user-supplied 'id' and 'name' attributes are concatenated directly into rendered HTML without proper sanitization or escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when users access injected pages. The vulnerability was published on 2026-05-27 with a CVSS 3.1 score of 6.4 (Medium severity).
- Vendor
- morettolss
- Product
- Google+ Link Name
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
WordPress site administrators using the Google+ Link Name plugin; security teams monitoring WordPress plugin vulnerabilities; organizations with contributor-level user accounts on WordPress installations
Technical summary
The gplusnamelink_generate() function in the Google+ Link Name WordPress plugin fails to sanitize or escape the 'id' and 'name' shortcode attributes before outputting them in HTML. This allows authenticated users with contributor privileges to inject malicious JavaScript via [gplusnamelink id='...' name='...'] shortcodes. The injected scripts execute in the context of users viewing the affected pages, enabling session hijacking, credential theft, or administrative action forgery.
Defensive priority
medium
Recommended defensive actions
- Update Google+ Link Name plugin to version 1.0.1 or later if available; otherwise, consider disabling or removing the plugin
- Review existing posts and pages for unauthorized [gplusnamelink] shortcode usage, particularly from contributor-level accounts
- Implement Content Security Policy (CSP) headers to mitigate impact of any injected scripts
- Consider restricting contributor-level permissions if shortcode usage is not required
- Monitor web application logs for suspicious shortcode submissions containing script tags or event handlers
Evidence notes
Vulnerability confirmed via WordPress plugin source code analysis showing direct attribute concatenation at lines 15 and 19 of gplusnamelink.php without esc_attr() or esc_html() calls. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness.
Official resources
2026-05-27