Description

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T06:16:44.640Z",
  "pubdate": "2026-11-06T06:16:44.640Z",
  "executiveSummary": "The ShopEngine Gutenberg WooCommerce Builder Blocks Addon plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This vulnerability arises due to insufficient input validation and output sanitization within the plugin's AJAX action processing logic. The vulnerability affects all versions of the plugin prior to 2.4.4. A malicious actor with 'Contributor' level privileges or higher can leverage this flaw to inject arbitrary JavaScript payloads into post data. The payload is stored server-side and is subsequently executed within the context of a victim's browser session—typically an administrator or high-privileged user—whenever they access the affected post via the WordPress editor. This effectively results in a Stored XSS condition that can lead to complete account compromise, unauthorized administrative actions, or session hijacking within the WordPress environment. Given that the exploitation does not require advanced technical skill, the risk to site integrity and security is high, necessitating immediate patching of the plugin.",
  "technicalDetails": "The vulnerability originates from a deficiency in access control and input sanitization within the ShopEngine Gutenberg WooCommerce Builder Blocks Addon AJAX handlers. Specifically, the plugin fails to implement necessary capability checks to restrict access to specific AJAX endpoints, and it does not verify that the user requesting a modification has authorized ownership or edit permissions for the targeted post object. Furthermore, data received through these AJAX actions is stored without adequate sanitization or escaping, and the subsequent rendering of this data into a JavaScript context during post editing facilitates the execution of malicious scripts.\nThe attack flow proceeds as follows: First, an authenticated attacker with 'Contributor' level access initiates a crafted AJAX request targeting the vulnerable plugin endpoint. The request includes an arbitrary JavaScript payload intended for execution within the WordPress dashboard. Because the plugin lacks server-side authorization checks, the request is processed, and the malicious payload is saved into the database as part of the post metadata or post content.\nThe second phase of the exploit occurs when a higher-privileged user, such as an Administrator or Editor, navigates to the WordPress dashboard to view or edit the compromised post. When the Gutenberg builder or the plugin's internal logic loads the post, the unsanitized payload is output directly into a JavaScript context. Because the browser interprets this injected code as part of the legitimate plugin functionality, the malicious script executes within the context of the privileged user's session.\nThe post-exploitation impact includes, but is not limited to, the execution of arbitrary administrative functions, unauthorized modification of site settings, the creation of new administrative accounts, or the theft of sensitive session cookies. Since the script executes within the victim's browser, the attacker can effectively bypass server-side security measures by performing actions on behalf of the authenticated, high-privileged victim. The primary vulnerability is categorized as Stored XSS, stemming from a lack of secure coding practices regarding input handling and output encoding within the WordPress AJAX framework.\nAffected versions are identified as all iterations of the ShopEngine Gutenberg WooCommerce Builder Blocks Addon prior to 2.4.4. The exposure is local to the WordPress dashboard, necessitating prior authentication, though the low privilege requirement makes this a significant vector for privilege escalation and site-wide compromise."
}