CVE-2026-8885 is a stored cross-site scripting vulnerability in the DeMomentSomTres Shortcodes WordPress plugin, specifically in the st_callout() function. The issue stems from insufficient input sanitization and output escaping of the 'width' and 'align' shortcode attributes, which are concatenated directly into an HTML style attribute. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 1.1.1. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the DeMomentSomTres Shortcodes plugin if feasible. Monitor for plugin updates that address this vulnerability.