Description

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T06:18:09.433Z",
  "pubdate": "2026-08-12T06:18:09.433Z",
  "executiveSummary": "The Patterns Kit WordPress plugin through 1.0.3 suffers from a Stored Cross-Site Scripting (XSS) vulnerability stemming from the improper sanitization and escaping of user-supplied link attributes.\nThe flaw allows authenticated malicious actors with low-privileged access, specifically users holding the Contributor role, to persistently store arbitrary JavaScript payloads within page content or post metadata.\nWhen a victimized user views the affected content and interacts with the compromised element by clicking it, the unsanitized payload is dynamically parsed and executed within the context of their browser session.\nThe potential impact includes unauthorized session hijacking, arbitrary client-side action execution, credential theft, and full compromise of administrative or standard user accounts depending on the privileges of the viewing user.\nExploitation requires authenticated access with at least Contributor-level privileges to inject the payload, combined with victim interaction (clicking the affected element) to trigger execution.",
  "technicalDetails": "The vulnerability resides in the Patterns Kit WordPress plugin affecting versions through 1.0.3, specifically within the handling and rendering of link attributes associated with plugin components.\nThe root cause of the vulnerability is the absence of proper output encoding and context-aware escaping mechanisms before client-side scripts process and insert user-controlled link attributes into the Document Object Model (DOM).\nAn attacker possessing a Contributor-level account can supply malicious input containing JavaScript payloads—such as event handlers or javascript: URIs—within the vulnerable link attributes during the creation or editing of posts and patterns.\nThe attack flow proceeds as follows: 1) The Contributor crafts a malicious post containing the unsanitized payload embedded within a link attribute. 2) The WordPress backend stores the payload in the database without adequate validation or sanitization. 3) A targeted user loads the rendered page containing the Patterns Kit component. 4) The client-side script parses the stored attribute and injects it into the page elements. 5) Upon the victim clicking the affected interactive element, the browser evaluates the malicious payload in the context of the active session.\nBecause the payload executes in the victim's browser, the attacker can leverage the victim's session cookies and permissions to perform unauthorized actions against the WordPress REST API, create rogue administrator accounts, or deface the site."
}