Description

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-10T04:17:48.130Z",
  "pubdate": "2026-09-10T04:17:48.130Z",
  "executiveSummary": "The Builderall for WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the Photo Module's 'attributes' setting.\nThis security flaw, affecting all versions up to and including 3.0.2, stems from inadequate input sanitization and output escaping mechanisms.\nThe vulnerability permits authenticated attackers possessing at least Contributor-level privileges to inject malicious client-side scripts into the plugin's metadata handling processes.\nOnce the payload is successfully injected and stored within the database, the script executes automatically in the browser of any user, including administrators, who views the compromised page.\nThe risk implications are critical as XSS can facilitate session hijacking, unauthorized actions performed on behalf of legitimate users, and the redirection of traffic to malicious external domains.\nSuccessful exploitation requires authenticated access to the WordPress dashboard with sufficient permissions to manipulate plugin settings, effectively bypassing security controls due to the lack of proper validation on user-supplied input.",
  "technicalDetails": "The vulnerability exists within the Photo Module component of the Builderall for WordPress plugin, specifically concerning the handling of the 'attributes' configuration field.\nThe root cause is identified as a failure to implement robust server-side sanitization on input parameters and a corresponding failure to perform context-aware output encoding when rendering these attributes in the frontend.\nAn authenticated user with Contributor-level access or higher can intercept the request or use the plugin interface to input crafted payload strings into the 'attributes' field.\nBecause the application does not validate or sanitize this data before storing it in the WordPress database, the malicious payload is persisted indefinitely.\nWhen a victim, such as an administrator, visits a post or page containing the affected Photo Module, the unsanitized 'attributes' data is injected directly into the HTML document's Document Object Model (DOM).\nThe browser interprets the malicious script as legitimate code, leading to unauthorized execution within the security context of the victim's session.\nThe attack flow follows a structured path: first, the attacker authenticates as a Contributor; second, they navigate to the Photo Module configuration interface; third, they inject a JavaScript payload (e.g., <script>alert(document.cookie)</script>) into the 'attributes' setting; fourth, the malicious string is saved to the database; and finally, when the page is accessed by other users, the script executes.\nThe impact is significant, as it allows for the theft of session cookies, the modification of page content to conduct phishing attacks, or the execution of unauthorized administrative actions via forged requests (CSRF) if the victim has elevated privileges.\nSince the vulnerability is stored, it achieves high persistence and can be used to target specific high-value users, thereby broadening the attack surface and increasing the likelihood of successful system compromise."
}