CVE-2026-8895 is a stored cross-site scripting vulnerability in the kk blog card WordPress plugin (up to version 1.3). The issue stems from improper neutralization of input in the 'href' and 'type' attributes of the 'blog-card' shortcode, which are directly concatenated into HTML attributes without adequate sanitization or escaping. Authenticated users with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, data theft, or other client-side impacts. The vulnerability does not affect availability. There are no known active exploits reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the kk blog card plugin until a fix is released. Avoid using the vulnerable shortcode with untrusted input.