Description

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-14T06:16:59.627Z",
  "pubdate": "2026-08-14T06:16:59.627Z",
  "executiveSummary": "The Embed Google Photos WordPress plugin through version 2.2.1 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. This security defect arises from the inadequate sanitization and contextual output encoding of user-supplied shortcode attributes.\nAn authenticated attacker possessing the Contributor role or higher can leverage this flaw to inject arbitrary malicious JavaScript payload vectors into vulnerable post contents. When a privileged user, such as an administrator, renders or views the affected post, the injected script executes within the context of their active browser session.\nThe resulting impact includes potential full administrative account compromise, session hijacking, arbitrary content modification, and further server-side or client-side compromise within the WordPress application ecosystem.\nExploitation requires authenticated access with at least Contributor privileges to create or edit posts containing the malicious shortcode, alongside user interaction from a higher-privileged user viewing the rendered output.",
  "technicalDetails": "The vulnerability resides within the shortcode processing logic of the Embed Google Photos WordPress plugin through version 2.2.1. The root cause of the issue is the direct reflection of shortcode attribute values directly into HTML attributes within the Document Object Model (DOM) output without applying proper contextual output escaping.\nIn WordPress architecture, shortcodes parse attributes passed by users. If a plugin developers fails to sanitize input upon intake and subsequently fails to escape output using appropriate functions such as esc_attr() before rendering attributes inside HTML tags, arbitrary HTML injection and JavaScript breakout conditions occur.\nThe attack flow proceeds as follows: First, an authenticated threat actor with the Contributor role drafts or edits a WordPress post, inserting a malicious shortcode payload crafted to break out of the target HTML attribute container (e.g., utilizing quote characters followed by event handlers like onload or onerror, or direct javascript: protocol schemes). Second, the WordPress database stores this malicious shortcode string persistently. Third, an administrative user or any other victim views the published or previewed post. Fourth, the plugin parses the shortcode and outputs the unescaped attribute directly into the HTML response sent to the browser. Finally, the browser parses the markup, interprets the injected script payload, and executes the arbitrary JavaScript in the security context of the victim's session.\nBecause the payload executes in the browser of users with higher privileges (such as administrators), the attacker can execute administrative actions via JavaScript, including the creation of new administrative accounts, installation of malicious plugins, or modification of core theme files to achieve remote code execution (RCE) on the underlying hosting server."
}