Description

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-12T06:16:26.353Z",
  "pubdate": "2026-09-12T06:16:26.353Z",
  "executiveSummary": "The Custom Menu Wizard Widget WordPress plugin, in versions up to and including 3.3.1, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw arises from the improper handling of shortcode attributes, which are rendered into the Document Object Model (DOM) without sufficient sanitization or output escaping.\nThe vulnerability allows an authenticated attacker with Contributor-level privileges or higher to inject malicious JavaScript payloads into post or page content via shortcodes. When a victim—such as an administrator or another user with higher privileges—views the compromised content, the injected script executes within the context of the victim's session.\nThe impact of this vulnerability includes potential unauthorized actions performed on behalf of the victim, session hijacking, or the redirection of users to malicious sites. Because the payload is stored persistently in the WordPress database, the vulnerability poses a significant risk to site integrity and user security. No external network interaction is required beyond the ability to create or edit posts, making this an internal privilege escalation and exploitation vector.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement robust input sanitization or output escaping mechanisms within the plugin's shortcode rendering logic. Specifically, the plugin parses attributes provided in shortcode tags and reflects these values directly into the HTML output. When the WordPress engine processes the shortcode, the lack of contextual encoding allows for the injection of arbitrary HTML tags, including script tags or event handlers such as 'onmouseover' or 'onerror'.\nAn attacker exploits this by crafting a specially formed shortcode containing an malicious payload within a vulnerable attribute. For example, by inserting a payload such as '[custom-menu-wizard-shortcode attribute=\"javascript:alert('XSS')\" ]', the attacker influences the rendered HTML output. Because the plugin processes these attributes dynamically, the browser interprets the unsanitized input as executable code rather than plain text.\nThe attack flow follows a predictable pattern: first, the attacker, possessing at least Contributor-level access, creates or modifies a post, page, or widget instance. During this phase, the attacker inserts the malicious shortcode into the content body. Second, the WordPress server saves this content directly into the database. Finally, when an unsuspecting user visits the page containing the shortcode, the server generates the response, embedding the attacker's script into the HTML delivered to the victim's browser. Upon page load, the victim's browser executes the script automatically.\nThe vulnerability affects Custom Menu Wizard Widget version 3.3.1 and all preceding versions. Since WordPress shortcodes are processed on the server-side before delivery to the client, the malicious payload bypasses typical client-side security filters unless specific WAF or Content Security Policy (CSP) rules are in place. The post-exploitation impact is severe, as an attacker could perform unauthorized administrative tasks, extract sensitive cookies or CSRF tokens, or modify site configurations by leveraging the victim's authenticated session permissions. The reliance on Contributor-level access defines the primary threat vector, meaning that internal users with minimal rights can escalate their impact to effectively compromise the front-end user experience and potentially compromise other users."
}