Description

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T06:16:39.460Z",
  "pubdate": "2026-11-06T06:16:39.460Z",
  "executiveSummary": "The MCB WordPress plugin, specifically in versions up to 1.0.0, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from the improper sanitization and escaping of HTTP request header values before they are persisted into the database.\nWhen an administrator accesses the statistics grid page, the application renders this malicious input, causing the browser to execute arbitrary JavaScript within the context of the administrator's authenticated session.\nThis allows unauthenticated attackers to perform unauthorized actions on behalf of the administrator, potentially leading to full site compromise, such as the creation of rogue administrator accounts, redirection of site traffic, or theft of sensitive session cookies.\nThe risk is categorized as high, as it requires no prior authentication and leverages the trusted context of a site administrator to execute malicious scripts.",
  "technicalDetails": "The root cause of the vulnerability is an input validation and output encoding failure within the MCB plugin. The application captures data from incoming HTTP request headers—such as 'User-Agent', 'Referer', or custom headers—and stores these raw values in the database for tracking purposes.\nThe plugin lacks a sanitization layer during the data ingestion process, allowing malicious payloads containing script tags or event handlers to be stored persistently.\nThe vulnerability is triggered when the administrator navigates to the plugin's 'statistics grid' interface. The vulnerable component retrieves the malicious stored strings from the database and injects them directly into the HTML document structure without applying sufficient context-aware output escaping (e.g., htmlspecialchars or esc_html).\nAn unauthenticated attacker can execute this attack by crafting a malicious HTTP request directed at the web server. The request header is populated with a JavaScript payload, such as '<script>alert(document.cookie)</script>'. Once the request is processed, the malicious payload is saved into the MCB storage table.\nWhen the administrator views the statistics page, the browser interprets the injected payload as legitimate application code and executes it within the DOM. Because this occurs within an active administrator session, the script inherits the administrator's privileges.\nThis enables post-exploitation activities such as cross-site request forgery (CSRF) to change site settings, modify plugin configurations, or inject persistent backdoors into the WordPress installation. Because the attack occurs via standard HTTP requests, it is network-accessible and requires no specific privilege level to initiate, making it a severe threat to any WordPress environment utilizing the affected version of the MCB plugin."
}