Description

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T12:17:19.287Z",
  "pubdate": "2026-11-06T12:17:19.287Z",
  "executiveSummary": "The Smart Cookie Kit plugin for WordPress, in all versions up to and including 2.3.2, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the 'comment' parameter.\nThis security flaw arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious JavaScript into web pages.\nThe vulnerability poses a high-risk to site integrity and visitor security, as the injected scripts execute within the context of the victim's browser whenever an affected post is viewed.\nExploitation requires a specific multi-stage attack flow: the attacker submits a malicious comment, which must be approved by an administrator. Once approved, the payload triggers when an administrator or user views the public-facing post containing the comment.\nThe impact includes potential session hijacking, administrative account compromise, or malicious redirection of users, as the injected scripts run with the privileges of the viewing user.",
  "technicalDetails": "The root cause of this vulnerability is a failure to sufficiently sanitize input and escape output within the 'comment' parameter handling logic of the Smart Cookie Kit plugin. The plugin mechanisms fail to neutralize malicious payloads that leverage the logic of WordPress's wp_kses function.\nThe exploitation method relies on the bypass of wp_kses filters during the initial save process. The attacker crafts a payload that embeds hostile characters within permitted HTML elements, specifically utilizing the <code> tag. By smuggling an attribute-breaking double-quote character inside the body of the <code> tag, the attacker effectively hides the payload from standard server-side sanitization routines.\nThe attack flow proceeds as follows: 1. The unauthenticated attacker submits a crafted comment containing the obfuscated payload. 2. The malicious content is stored in the database. 3. An administrator must approve the comment via the WordPress dashboard, inadvertently facilitating the attack. 4. Once approved, the plugin's internal output buffer processes the comment at render time. During this phase, the plugin reconstructs the smuggled characters into a functional <code>&lt;abbr title&gt;</code> attribute. 5. When a user subsequently visits the public post, the browser interprets the reconstructed HTML, executing the arbitrary JavaScript embedded within the title attribute.\nBecause the payload is reconstructed dynamically during output rendering, it evades static detection mechanisms. The vulnerable component is the output rendering engine of the Smart Cookie Kit plugin. The attack is effective against all versions up to and including 2.3.2.\nThe post-exploitation impact is significant. If an administrator views the affected page, the executing script can perform unauthorized actions on their behalf, such as creating new administrative accounts, modifying plugin configurations, or injecting additional malicious code into the WordPress environment. The vulnerability demonstrates a critical failure in the plugin's data handling lifecycle, where the trust boundary between input storage and output reflection is successfully crossed."
}