A vulnerability was found in marcqueralt DeMomentSomTres Shortcodes Plugin up to 1.1.1 on WordPress. It has been rated as problematic . This issue affects the function st_callout of the component Shortcode Handler . Performing a manipulation of the argument width/align results in cross site scripting. This vulnerability is cataloged as CVE-2026-8885 . It is possible to initiate the attack remotely. There is no exploit available.