Description

Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T21:17:51.783Z",
  "pubdate": "2026-08-31T21:17:51.783Z",
  "executiveSummary": "The Kalles Addons plugin for WordPress, in all versions up to and including 1.0.6, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper input sanitization and output encoding of user-supplied data. The vulnerability permits authenticated users with Subscriber-level privileges to inject malicious JavaScript into web pages rendered by the application.\nThe risk implication is significant, as an attacker can execute arbitrary scripts within the context of a victim's session. Depending on the target victim—such as an administrator—the impact can lead to full site compromise, session hijacking, unauthorized administrative actions, or the redirection of users to malicious third-party domains. Exploitation requires the attacker to possess an active subscriber account, making it a lateral movement risk from a lower-privileged user to a higher-privileged entity. No specialized network access beyond standard HTTP/HTTPS interaction is required for successful exploitation.",
  "technicalDetails": "The vulnerability exists due to a failure in the Kalles Addons codebase to adequately sanitize input parameters before they are stored in the WordPress database and subsequently rendered to the browser. In versions 1.0.6 and below, the plugin does not implement sufficient output escaping mechanisms when handling specific user-controllable inputs within its administrative or front-end components.\nThe attack flow begins when an authenticated user with Subscriber privileges interacts with a vulnerable input field or parameter handled by Kalles Addons. The attacker crafts a payload containing malicious JavaScript, such as '<script>alert('XSS')</script>' or an event-based trigger like '<img src=x onerror=alert(1)>', and submits it to the application. Because the plugin processes these requests without applying stringent data validation or sanitization routines, the payload is persisted directly into the database.\nWhen a legitimate user—most notably an administrative user viewing the affected page or dashboard—accesses the page where the injected payload resides, the application outputs the raw, unescaped malicious script. The browser parses the response and executes the embedded JavaScript within the security context of the victim's current session. Since the script is executed in the user's browser, it gains the ability to access document cookies (if not protected by the HttpOnly flag), manipulate DOM elements, or perform actions on behalf of the victim via AJAX requests.\nThe root cause is the reliance on insecure input handling practices within the plugin’s processing functions. By failing to leverage WordPress's built-in security functions like 'sanitize_text_field()' for input or 'esc_html()', 'esc_js()', or 'esc_attr()' for output, the plugin provides a clear vector for injection. This vulnerability is categorized as Stored XSS because the malicious payload resides permanently on the server until it is explicitly removed by an administrator or through database modification. The lack of capability checks or nonce verification for the affected endpoints further exacerbates the vulnerability, allowing any user with the Subscriber role to perform the injection."
}