WordPress Canvas - Shortcodes 1.92 Cross Site Scripting

`------------------------------------------------------------------------  
Stored Cross-Site Scripting in WP Canvas - Shortcodes WordPress Plugin  
------------------------------------------------------------------------  
Yorick Koster, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
A Cross-Site Scripting vulnerability was found in the WP Canvas -  
Shortcodes WordPress Plugin. This issue allows an attacker to perform a  
wide variety of actions, such as stealing Administrators' session  
tokens, or performing arbitrary actions on their behalf. This issue can  
be exploited by authenticated users with the Contributor or higher role.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160724-0031  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
This issue was successfully tested on WP Canvas - Shortcodes WordPress  
Plugin version 1.92.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
This issue has been addressed in WP Canvas - Shortcodes WordPress Plugin  
version 2.07.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_in_wp_canvas___shortcodes_wordpress_plugin.html  
  
This issue exists due to the lack of validation on the url attributed of the wc_button shortcode. A Contributor or higher can create a button with a specially crafted Javascript payload. When a (logged) on user clicks on this button, the payload will be executed. This bypasses the unfiltered_html privilege of WordPress, which is normally only assigned to Editors & Administrators.  
  
Proof of concept  
  
[wc_button type="primary" url="javascript:alert(1)" title="Visit Site" target="self" position="float"]Sample Content[/wc_button]  
  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`