CVE-2026-8896 is a stored cross-site scripting vulnerability in the MIR blocks and shortcodes WordPress plugin, affecting versions up to and including 1.0.0. The vulnerability is due to insufficient input sanitization and output escaping in the msc_stats() rendering function, specifically in processing shortcode attributes like 'title' and 'ready_animation_text'. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts without availability loss.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure and integrity compromise of user sessions or data. There is no direct impact on availability. The vulnerability requires authentication but has a low attack complexity and no user interaction needed for exploitation.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the MIR blocks and shortcodes plugin until a fix is released. Review and sanitize any user-generated shortcode attributes manually if possible.