Description

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-22T06:16:49.597Z",
  "pubdate": "2026-09-22T06:16:49.597Z",
  "executiveSummary": "The Contextual Related Posts plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping. Affecting all versions up to and including 4.4.1, this flaw permits authenticated users with author-level permissions or higher to inject malicious JavaScript into plugin block parameters.\nThe vulnerability resides in the handling of the 'other_attributes' parameter. By supplying crafted payloads within this parameter, an attacker can ensure the execution of arbitrary scripts whenever an administrator or end-user views a compromised page. This represents a significant security risk, as successful exploitation can lead to unauthorized actions, session hijacking, or the defacement of the affected website. Because the payload is stored persistently within the database, the malicious script executes automatically upon rendering the injected block, requiring no further interaction from the attacker. Organizations utilizing this plugin should treat this as a high-priority security issue, as it grants elevated actors the ability to compromise the integrity of the administrative interface and the visitor-facing frontend.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw, stemming from the application's failure to adequately sanitize the 'other_attributes' parameter within the block rendering logic. The root cause is the lack of context-aware output encoding or strict input validation when processing user-supplied attributes intended for HTML elements.\nIn the context of the WordPress Block Editor, developers often allow users to pass custom attributes to shortcodes or block configurations. The Contextual Related Posts plugin fails to filter these attributes, allowing an attacker to inject event handlers (e.g., 'onmouseover', 'onerror') or script tags if the parsing logic does not effectively strip dangerous characters or HTML tags. When the block is saved to the database, the malicious payload is stored alongside the page content.\nThe attack flow begins when an attacker with at least author-level privileges accesses the block editor. The attacker adds or modifies a 'Contextual Related Posts' block and populates the 'other_attributes' field with a malicious payload, such as a JavaScript execution string designed to exfiltrate cookies or perform administrative actions via 'document.cookie' or 'wp.ajax'.\nOnce the page is saved, the vulnerable component retrieves the stored attribute from the database. During the page rendering process, the plugin inserts this attribute directly into the HTML markup of the frontend page without applying appropriate security functions such as 'esc_attr()' or 'wp_kses()'.\nConsequently, when a victim—which could include a site administrator—navigates to the page where the block is rendered, the browser parses the injected payload as valid script code. This results in the execution of the payload within the security context of the victim's session. Since the script runs in the user's browser, the attacker can leverage the victim’s existing authentication to perform unauthorized administrative operations, such as creating new malicious user accounts, installing plugins, or modifying site settings.\nThis vulnerability is particularly dangerous because it bypasses standard client-side protections. The requirement for author-level authentication limits the initial entry vector but remains a significant threat, as author accounts are frequently targeted for credential harvesting. The persistent nature of the storage ensures that the script triggers consistently for any user visiting the page, providing a reliable delivery mechanism for the attacker."
}