CVE-2026-86790: Unknown Wp Highlight Box

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

• Unknown Wp Highlight Box: up to and including 1.0

Published 2026-09-12. Last modified 2026-09-14.