Junglewise Threat Intelligence

CVE-2026-8883: Global Body Mass Index Calculator Stored XSS via gbmicalc shortcode

CVE-2026-8883 · Severity: medium · CVSS 6.4 · Published 2026-06-09

Executive brief

The Global Body Mass Index Calculator plugin for WordPress, which provides BMI calculation tools for websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Technical details

The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'gbmicalc' shortcode in versions up to 1.2. The vulnerability exists within the GBMI_Calc_Widget::widget() function, where shortcode attributes are extracted into local variables using @extract($args) without sufficient sanitization. These variables are subsequently echoed unescaped into HTML style attributes (height/width) and the HTML body (title), enabling attribute-breakout payloads. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript. The scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or unauthorized administrative actions.

Affected products

  • Global Body Mass Index Calculator Global Body Mass Index Calculator up to, and including, 1.2

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory

References