Description

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-15T13:16:40.687Z",
  "pubdate": "2026-09-15T13:16:40.687Z",
  "executiveSummary": "The Bridge - Creative Multipurpose WordPress Theme is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists due to inadequate sanitization and improper output escaping within the 'circle_line' shortcode attribute.\nThe vulnerability affects all versions of the Bridge theme up to and including version 30.8.9.1. An authenticated attacker possessing at least contributor-level privileges can inject malicious JavaScript payloads into post or page content through this shortcode.\nSuccessful exploitation allows for the execution of arbitrary scripts in the browser of any user who views the affected page, including high-privileged administrators. The impact of this vulnerability includes potential session hijacking, unauthorized actions performed on behalf of the victim, and unauthorized data exfiltration.\nGiven that the injection is stored permanently in the database, the risk profile is significant. Mitigation requires updating the theme to a version where this attribute is properly sanitized or applying security patches provided by the vendor.",
  "technicalDetails": "The vulnerability originates from the 'circle_line' shortcode processing logic within the Bridge WordPress theme. The theme fails to implement robust input validation or context-aware output encoding on the attributes passed to this shortcode. Consequently, user-supplied input is rendered directly into the HTML document object model (DOM) without sufficient sanitization, enabling the injection of malicious script tags or event handlers.\nAn attacker with contributor-level privileges or higher can weaponize this by creating or editing a post and including the [circle_line] shortcode with a payload embedded in the vulnerable attribute. For example, injecting a payload such as '<script>alert(document.cookie)</script>' or using HTML event handlers like 'onload' within the attribute string allows the attacker to break out of the intended HTML attribute context.\nWhen a user, such as an administrator, visits the affected page, the WordPress shortcode parser processes the input, and the unsanitized payload is delivered to the victim's browser. The browser interprets the injected string as legitimate executable code rather than plain text, resulting in the execution of the attacker's JavaScript within the security context of the victim's session.\nThe execution flow occurs as follows: 1) The authenticated attacker submits a post containing the malicious shortcode string via the wp-admin interface. 2) The server stores the malicious string in the WordPress database (wp_posts or wp_postmeta tables). 3) A victim navigates to the rendered page. 4) The server fetches the malicious string from the database and embeds it into the theme's output buffer. 5) The victim's web browser receives the response and executes the injected script.\nBecause the payload is persistent, the script executes every time the page is loaded by any user. Post-exploitation impact is severe, as the attacker can manipulate the DOM to conduct phishing attacks, capture sensitive session cookies for account takeover, or trigger cross-site request forgery (CSRF) by forcing the victim's browser to execute unauthorized administrative requests."
}