CVE-2026-8883 is a stored cross-site scripting vulnerability in the Global Body Mass Index Calculator WordPress plugin (versions up to and including 1.2). The issue stems from the GBMI_Calc_Widget::widget() function, which extracts shortcode attributes directly into local variables using @extract($args) and outputs them unescaped into HTML style attributes and body content. This allows authenticated attackers with contributor or higher privileges to inject arbitrary scripts via crafted shortcode attributes, leading to script execution in the context of users viewing the injected pages.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the 'gbmicalc' shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid using the vulnerable shortcode in published content. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.