CVE-2026-8841 is a stored cross-site scripting vulnerability in the Extra Settings for RocketChat WordPress plugin (versions up to and including 0.1). The vulnerability arises from insufficient input sanitization and output escaping in the rxstg_shortcode() function, which directly concatenates the user-supplied 'title' attribute into HTML output. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts that execute in the context of users visiting the compromised pages.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages using the 'rocketchat' shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users and consider removing or disabling the Extra Settings for RocketChat plugin if feasible.