Description

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T07:16:48.493Z",
  "pubdate": "2026-08-10T07:16:48.493Z",
  "executiveSummary": "The Saitama Addon Pack WordPress plugin through version 1.0.8 suffers from a stored Cross-Site Scripting (XSS) vulnerability. The security flaw arises due to the lack of proper input sanitization and output escaping on specific post metadata values handled by the plugin. This vulnerability poses a significant risk to administrative integrity within targeted WordPress environments. An authenticated attacker possessing contributor-level privileges or higher can successfully inject malicious script payloads into post metadata fields. When a higher-privileged user, such as an administrator or editor, reviews the compromised content within the administrative dashboard, the injected script executes within the context of their active browser session. This malicious execution can lead to severe security implications, including unauthorized administrative actions, session hijacking, or the complete compromise of the affected WordPress site. Successful exploitation requires authenticated access with at least contributor permissions and relies on social engineering or administrative interaction through the review interface to trigger the payload execution.",
  "technicalDetails": "The vulnerability resides in the post metadata handling routines of the Saitama Addon Pack WordPress plugin, specifically affecting all versions through 1.0.8. The root cause of the security defect is the failure of the application to properly sanitize incoming post metadata values upon input and to securely escape those values prior to rendering them in the Document Object Model (DOM). In the context of the WordPress architecture, post metadata associated with posts or pages is stored in the database without sufficient validation. Because the plugin processes these metadata attributes and outputs them directly into the administrative interface without applying context-aware output encoding (such as esc_html(), esc_attr(), or similar sanitization functions), an arbitrary JavaScript injection vector is created.\nThe attack flow proceeds in a sequential manner. First, an authenticated malicious actor authenticated with contributor-level privileges or higher creates or edits a post leveraging the WordPress publishing workflow. During this phase, the attacker supplies a crafted payload containing malicious JavaScript within the vulnerable post metadata fields managed by the Saitama Addon Pack plugin. The application accepts these inputs and persists them directly into the database storage layer without stripping or neutralizing executable script tags or event handlers. Next, the content is submitted for review, which is standard procedure for users constrained by contributor permissions who cannot publish directly. Subsequently, a higher-privileged user, such as an administrator possessing the capability to review and publish submitted content, navigates to the administrative dashboard to inspect the pending post. When the vulnerable component of the plugin renders the stored post metadata within the administrative interface, the raw payload is output directly into the HTML response without proper escaping. As a result, the victim's browser parses the injected string as executable script code rather than harmless text. The payload executes immediately within the authenticated session of the higher-privileged user, operating with their elevated permissions and access rights. This enables the attacker to perform privileged actions on behalf of the victim, potentially creating new rogue administrator accounts, modifying core application files, or exfiltrating sensitive session cookies and data."
}