Description

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-10T07:16:46.597Z",
  "pubdate": "2026-08-10T07:16:46.597Z",
  "executiveSummary": "A Stored Cross-Site Scripting vulnerability exists in the Advanced Excerpt WordPress plugin before version 4.5. The vulnerability arises from insufficient sanitization and escaping of a specific plugin setting prior to rendering it on the front end of the affected website. This security deficiency allows privileged users, specifically administrators lacking the unfiltered_html capability such as those in WordPress multisite configurations, to inject arbitrary web scripts or HTML code into application pages. When visitors browse pages rendering the affected excerpt settings, the malicious payload executes within the security context of the victim's browser session. The risk implication includes potential session hijacking, unauthorized actions performed on behalf of the user, and defacement of the front-end interface. Exploitation requires administrative privileges without the unfiltered_html capability and relies on the user successfully modifying the vulnerable plugin setting with malicious input.",
  "technicalDetails": "The vulnerability stems from improper input validation and output encoding in the Advanced Excerpt WordPress plugin prior to version 4.5. Specifically, the vulnerable component fails to adequately sanitise and escape user-supplied data within one of its configurable plugin settings before outputting the value to the Document Object Model (DOM) on the front end of the site. The root cause is categorized as a lack of contextual output escaping and lack of strict input sanitization on persistent configuration parameters.\nAuthentication and privilege requirements involve an attacker holding administrative privileges on the target WordPress installation, though specifically restricted from having the unfiltered_html capability. This common restriction is often enforced in WordPress multisite environments to prevent lower-tier site administrators from executing arbitrary markup. Network exposure is external, as the payload is rendered on the front end of the site where public visitors interact with the web application.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker with administrative privileges accesses the Advanced Excerpt plugin settings panel within the WordPress administration dashboard. Second, the attacker inputs a crafted payload containing malicious JavaScript into the vulnerable setting field. Third, the application saves the unsanitized string directly into the database without applying proper validation or sanitization routines. Fourth, when an unauthenticated or authenticated visitor requests a front-end page that loads the affected excerpt setting, the application retrieves the stored malicious payload from the database and echoes it directly into the HTML response without applying proper output encoding.\nThe payload behavior involves executing arbitrary JavaScript in the context of the victim browser session. Post-exploitation impact includes the ability to perform actions on behalf of the victim, access session cookies, steal sensitive authentication tokens, manipulate the DOM of the affected page, or redirect users to malicious external sites."
}