CVE-2026-8882 is a stored Cross-Site Scripting vulnerability in the WP ApplicantStack Jobs Display plugin for WordPress. The flaw exists in all versions up to and including 1.1.1 and allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts via shortcode attributes. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied shortcode attributes. This can lead to script execution in the context of users viewing the injected pages, potentially compromising user sessions or data.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published as of the provided data. Until a patch is available, restrict contributor-level access and above to trusted users only to reduce risk. Monitor for plugin updates from jdm-labs and apply any official fixes promptly once released.