Description

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode's all_page="1" attribute can be used to force the widget to render on any page, expanding the attack surface beyond shop and category pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T10:16:51.333Z",
  "pubdate": "2026-07-23T10:16:51.333Z",
  "executiveSummary": "The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position' shortcode attribute in all versions up to, and including, 3.0.9. This security defect arises due to insufficient input sanitization and improper output escaping mechanisms applied to user-supplied shortcode parameters.\nThe vulnerability allows authenticated attackers possessing contributor-level access and above to inject arbitrary web scripts, including malicious JavaScript payloads, into posts, pages, or other content vectors. When unsuspecting users or administrators access a page containing the injected payload, the script executes within the context of their browser session.\nFurthermore, the shortcode's all_page=\"1\" attribute can be explicitly leveraged to force the vulnerable widget to render globally across any arbitrary page, significantly expanding the attack surface beyond standard shop and category views.\nThe potential impact includes session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users, and defacement of the affected WordPress site. Successful exploitation requires authenticated access with at least contributor privileges and interaction from a victim visiting the injected page.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied input within the 'position' attribute of the plugin's shortcode implementation. Specifically, the software fails to adequately sanitize input data received through shortcode parameters and subsequently fails to apply context-aware output escaping before rendering the data in the Document Object Model (DOM).\nThe vulnerable component is the shortcode parsing and rendering engine of the Grid/List View for WooCommerce plugin, affecting all software versions up to, and including, 3.0.9. Attackers must authenticate to the WordPress site with contributor-level privileges or higher, which typically allows the creation or editing of posts and pages where shortcodes can be embedded.\nThe exploitation method involves crafting a malicious shortcode payload that incorporates arbitrary JavaScript into the 'position' attribute. Additionally, the attacker can append the all_page=\"1\" attribute to the shortcode configuration. By utilizing this attribute, the attacker forces the widget and its associated injected payload to render globally on any page across the WordPress installation, amplifying the visibility and reach of the execution vector beyond the default shop and category pages.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with contributor-level permissions authors or modifies a post or page, embedding the malicious shortcode containing the XSS payload within the 'position' attribute alongside the all_page=\"1\" directive. Second, the WordPress application processes the shortcode during page rendering, passing the unsanitized string directly to the output buffer without appropriate neutralization. Third, a victim or administrative user navigates to the injected page. Finally, the browser parses the HTML response, interprets the injected script as executable code, and runs the malicious JavaScript within the security context of the victim's session.\nThe post-exploitation impact depends on the privileges of the victim executing the script. If an administrator views the injected page, the execution of arbitrary JavaScript can lead to full site compromise through the creation of unauthorized rogue administrative accounts, installation of malicious plugins, or redirection of traffic."
}