CVE-2026-8885 | marcqueralt DeMomentSomTres Shortcodes Plugin up to 1.1.1 on WordPress Shortcode st_callout width/align cross site scripting

A vulnerability was found in marcqueralt DeMomentSomTres Shortcodes Plugin up to 1.1.1 on WordPress. It has been rated as problematic. This issue affects the function st_callout of the component Shortcode Handler. Performing a manipulation of the argument width/align results in cross site scripting.

This vulnerability is cataloged as CVE-2026-8885. It is possible to initiate the attack remotely. There is no exploit available.