CVE-2026-8893 is a stored cross-site scripting vulnerability in the Express Payment For Stripe WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'type' attribute in the [stripe-express] shortcode. The attribute value is directly concatenated into an HTML attribute in the register_shortcode() function without being passed through esc_attr() or equivalent escaping functions. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of users viewing the injected page.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required (low), no user interaction, and scope change with low confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.