CVE-2026-8844 is a stored cross-site scripting vulnerability in the Responsive Check WordPress plugin (versions up to 0.0.3). The issue arises from insufficient input sanitization and output escaping of the 'url' and 'button' attributes in the 'rspcheck' shortcode, specifically within the rspc_check_shortcode() function. These attributes are directly echoed into iframe src attributes without using esc_attr() or esc_url(), allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. This can lead to script execution in the context of any user viewing the injected page.

An attacker with contributor-level or higher access can inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure or session hijacking limited to the scope of the affected site. The vulnerability does not impact availability and requires authenticated access, reducing its overall risk but still posing a significant threat to site integrity and user security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider removing or disabling the Responsive Check plugin if it is not essential. Monitor for updates from the vendor or plugin author regarding patches or security improvements.