Description

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-11T07:16:46.277Z",
  "pubdate": "2026-09-11T07:16:46.277Z",
  "executiveSummary": "The advanced-customized-prompts WordPress plugin through version 1.0.1 contains a critical Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the failure to implement appropriate security controls—specifically capability checks, ownership verification, and nonce validation—when processing product popup configuration settings.\nThis vulnerability allows any authenticated user, including those with minimal privileges such as subscribers, to inject arbitrary JavaScript payloads into product configurations. These malicious scripts are subsequently stored in the database and executed within the browser session of any user—including high-privileged administrators—who views the affected product page.\nThe impact of this vulnerability is severe, as it facilitates unauthorized execution of JavaScript in the context of the victim's session. This may lead to account takeover, unauthorized administrative actions, sensitive data exfiltration, or defacement of the affected website. Because the payload resides in the product configuration, the attack vector is persistent and requires no interaction beyond viewing the compromised content, posing a significant risk to the integrity and confidentiality of the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control and input sanitization mechanism within the advanced-customized-prompts plugin. Specifically, the administrative interface responsible for saving popup configurations fails to perform any verification of the current user's capabilities. Furthermore, the absence of a security nonce allows the application to be susceptible to unauthorized request submission.\nThe attack flow begins when an attacker, authenticated as a subscriber, submits a crafted request to the plugin's configuration-saving endpoint. Because the plugin logic does not validate if the user is authorized to modify product metadata, the server accepts the input without restriction. The malicious payload, consisting of arbitrary JavaScript, is saved directly into the product configuration fields in the WordPress database without any output encoding or sanitization.\nWhen a legitimate user, such as a site administrator, navigates to the front-end or back-end page where the product is rendered, the plugin retrieves the stored, unescaped JavaScript and injects it directly into the HTML document. The victim's browser, interpreting the injected script as legitimate code originating from the trusted origin, executes the payload.\nExploitation is trivial and does not require complex reconnaissance. The attacker only needs access to the product editing or configuration features exposed by the plugin. By injecting script tags or event handlers, an attacker can steal session cookies, manipulate the Document Object Model (DOM), or perform actions on behalf of the victim through asynchronous requests initiated from the victim's browser. Since there is no input sanitization applied to the stored values, the application is unable to distinguish between benign configuration data and malicious executable code. This lack of output encoding ensures that the payload will trigger whenever the vulnerable data is rendered in the browser of any user, effectively bypassing standard browser-side security headers if those headers do not explicitly forbid the injected execution patterns.\nThe vulnerability affects all versions of the advanced-customized-prompts plugin up to and including 1.0.1. No specific network exposure beyond standard web access is required, and the exploit is fully functional within the legitimate scope of the plugin's documented features."
}