Description

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-02T15:17:35.957Z",
  "pubdate": "2026-09-02T15:17:35.957Z",
  "executiveSummary": "The LiveJournal Shortcode plugin for WordPress, specifically versions 1.1.1 and earlier, contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from the improper sanitization and escaping of shortcode attributes during the rendering process.\nBy injecting malicious JavaScript into vulnerable shortcode parameters, an authenticated attacker with at least 'contributor' level privileges can execute arbitrary scripts in the context of a victim's browser session.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment. Successful exploitation allows an attacker to intercept administrative sessions, perform unauthorized actions on behalf of privileged users, or redirect users to malicious external domains.\nThe attack is classified as Stored XSS because the malicious payload is saved within the post or page content stored in the WordPress database. Every time a user views the affected page, the malicious script is executed. This vulnerability requires authenticated access to the WordPress dashboard, specifically targeting accounts capable of creating or editing posts.\nSite administrators are advised to restrict user capabilities and monitor for updates to the plugin, as the vulnerability remains present in all versions up to and including 1.1.1.",
  "technicalDetails": "The vulnerability resides in the core processing logic of the LiveJournal Shortcode plugin, specifically where the plugin handles user-supplied shortcode attributes. The root cause is a failure to apply robust input validation and context-aware output escaping to these attributes before they are rendered in the HTML document object model (DOM).\nIn WordPress, shortcodes are processed by the Shortcode API. When the LiveJournal Shortcode plugin encounters its registered shortcode, it extracts the attributes provided by the user. If the plugin code directly echoes these attributes into the page output without utilizing WordPress security functions such as esc_attr(), esc_html(), or sanitize_text_field(), the input is treated as raw HTML or JavaScript.\nAn attacker with the 'contributor' role or higher can insert a crafted shortcode into a post or page. For instance, an attacker could define a shortcode attribute with a payload such as: [lj_shortcode attribute='\" onerror=\"alert(document.cookie)\"']. When this content is rendered on the frontend, the browser interprets the injected attribute as an event handler, triggering the execution of the JavaScript payload.\nThe attack flow follows these steps: 1) The attacker crafts a malicious shortcode payload containing a script or event handler. 2) The attacker saves the malicious shortcode within a page or post. 3) The plugin's rendering engine retrieves the post data from the database. 4) The plugin injects the unescaped malicious string into the HTML output delivered to the user's browser. 5) When a user (potentially an administrator) views the post, the browser executes the injected JavaScript code.\nBecause the payload is persisted in the database, this vulnerability allows for ongoing exploitation. The impact is significant, as it enables session hijacking via document.cookie theft, unauthorized administrative actions triggered by the current user's session, and potential redirection to phishing sites. The scope of the impact depends on the privileges of the victim viewing the compromised content. Since the vulnerability is located within the plugin's parsing logic, the attack is limited to users capable of invoking the specific shortcode, effectively restricting this to authenticated contributors and above. There is no automated remote network exposure for unauthenticated users, as the attack vector requires a WordPress user account with sufficient editing capabilities."
}