Why is this 8.8?

It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.

Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.