CVE-2026-8896 is a stored cross-site scripting vulnerability in the MIR blocks and shortcodes WordPress plugin, specifically in the msc_stats() rendering function. The plugin fails to properly sanitize and escape user-supplied shortcode attributes such as 'title' and 'ready_animation_text'. This allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability affects versions up to and including 1.0.0. No official patch or remediation has been documented at this time.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the MIR blocks and shortcodes plugin if possible to prevent exploitation.