Description

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-12T06:16:27.427Z",
  "pubdate": "2026-09-12T06:16:27.427Z",
  "executiveSummary": "The WP Highlight Box WordPress plugin through version 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output encoding of shortcode attributes.\nThe vulnerability allows authenticated users with at least the Contributor role to inject malicious JavaScript payloads into post or page content via shortcode parameters.\nWhen a victim, such as an administrator or another user, views the rendered page containing the compromised shortcode, the injected script executes within the context of the victim's browser session.\nThis flaw poses a significant security risk, as successful exploitation enables attackers to perform unauthorized actions on behalf of the victim, steal session cookies, capture sensitive data, or redirect users to malicious websites.\nThe attack is classified as Stored XSS because the payload is permanently saved in the WordPress database and rendered every time the target post is accessed.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of user-supplied data within the plugin's shortcode implementation. Specifically, the plugin parses shortcode attributes but fails to implement necessary sanitization (e.g., using WordPress functions like sanitize_text_field) or output escaping (e.g., esc_html or esc_attr) before rendering the data back to the browser.\nIn WordPress, the shortcode mechanism allows users to define parameters that influence the behavior or appearance of a component. The WP Highlight Box plugin processes these attributes and directly echoes them into the HTML structure of the page without validating their content. This behavior creates a Cross-Site Scripting vector where arbitrary HTML tags or JavaScript event handlers can be injected into the DOM.\nAn attacker with Contributor-level privileges, who is authorized to create or edit posts, can craft a malicious shortcode payload. For example, by providing an attribute value containing an 'onerror' event handler, such as [wp_highlight_box attribute=\"x\" onerror=\"alert('XSS')\"], the attacker can force the browser to execute arbitrary code when the shortcode container element fails to load or is manipulated.\nThe attack flow follows a predictable pattern: first, the authenticated attacker inserts the malicious shortcode into the post editor. The WordPress database stores this malicious content as part of the post's HTML body. When a legitimate user visits the post, the WordPress shortcode API triggers the plugin's rendering function, which outputs the unescaped attribute directly into the HTML document. The victim's browser then interprets the payload as executable code rather than plain text, completing the XSS execution.\nBecause the payload is stored within the page content, the vulnerability is persistent and will affect any user who views the page, regardless of their role. The impact is elevated if an administrator views the page, potentially allowing the attacker to perform administrative actions such as creating new users, modifying plugin settings, or injecting malicious content into other parts of the site via the WP REST API or admin-ajax endpoints."
}