CVE-2026-8842 is a stored cross-site scripting vulnerability in the Google+ Link Name plugin for WordPress, affecting versions up to and including 1.0. The issue stems from insufficient input sanitization and output escaping of the 'id' and 'name' attributes in the gplusnamelink_generate() function. These attributes are concatenated directly into the rendered HTML without calling esc_attr() or esc_html(), enabling authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts. This vulnerability can lead to script execution in the context of users viewing the compromised pages.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the affected WordPress site. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Google+ Link Name plugin if possible. Monitor official sources for updates or patches addressing this vulnerability.