Description

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-02T15:17:36.840Z",
  "pubdate": "2026-09-02T15:17:36.840Z",
  "executiveSummary": "The Icegram Express WordPress plugin, in versions prior to 5.8.6, contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping.\nThis vulnerability allows an authenticated user with Administrator privileges to inject malicious JavaScript payloads into a list description setting, which is subsequently rendered within an HTML attribute on the plugin's interface.\nThe primary risk involves the execution of arbitrary scripts in the context of an administrator's browser session, which could lead to administrative account takeover, unauthorized modification of plugin configurations, or the execution of unauthorized actions on behalf of the administrator.\nExploitation requires an attacker to possess active administrative credentials to the WordPress installation.\nThe vulnerability highlights a failure in properly handling user-supplied data before rendering it in an HTML context, violating the principle of least privilege and secure coding practices for output sanitization.",
  "technicalDetails": "The vulnerability resides in the improper handling of user-supplied input for the 'list description' setting within the Icegram Express plugin. Specifically, the application accepts this input and persists it into the database without adequate sanitization or subsequent encoding during the rendering phase.\nThe root cause is a failure to sanitize or escape user-controlled data before it is injected into the HTML DOM within an attribute context. When the plugin processes this setting for display, the browser interprets the input as executable code if the attacker injects characters that break out of the intended HTML attribute (e.g., using quotes to close an attribute and adding event handlers like 'onmouseover' or 'onerror').\nAn attack flow begins with an authenticated administrator navigating to the settings interface of the Icegram Express plugin. The attacker inputs a crafted XSS payload into the 'list description' field. Because the plugin does not validate or escape the input, the payload is stored directly in the WordPress database.\nUpon saving the settings, the plugin renders the affected list description in the administration panel. When an administrator views the page where this description is displayed, the browser executes the malicious script embedded in the attribute. Because this is a Stored XSS vulnerability, the payload executes every time the affected page is rendered, provided the payload remains in the database.\nThe impact of this exploit includes the ability to perform actions on behalf of the administrator, such as creating new administrative accounts, modifying site settings, or exfiltrating sensitive session cookies or CSRF tokens. This could lead to a full site compromise if the injected script interacts with the WordPress REST API or other administrative functions.\nThe vulnerability is restricted to versions prior to 5.8.6. It necessitates Administrator-level privileges, meaning the attack vector is confined to internal site management. However, given the nature of WordPress site management, this remains a critical security concern as it allows for persistent malicious script execution within the high-privilege administrative backend environment."
}