CVE-2026-8905 describes a CSRF vulnerability in the Osiris Signature Banner WordPress plugin (osiris8). The issue is due to missing or incorrect nonce validation in a function that handles settings updates. This flaw allows unauthenticated attackers to perform unauthorized actions by tricking an authenticated site administrator into executing a forged request, potentially leading to malicious script injection and settings manipulation. The vulnerability affects all versions up to and including 0.5. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker to update plugin settings and inject malicious web scripts by leveraging a forged request executed by an authenticated administrator. This can lead to partial compromise of site integrity and confidentiality, but does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider disabling or removing the Osiris Signature Banner plugin if possible to reduce exposure.