Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

// Examples of typical vulnerable shortcode implementation logic in WordPress plugins
// File: includes/shortcodes.php (approximate)

function rc_register_form_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => 'rc-register-form',
        'class' => '',
        // other attributes
    ), $atts);

    // Vulnerable: Attribute 'class' used directly in output without escaping
    return '<div id="' . $atts['id'] . '" class="' . $atts['class'] . '">...</div>';
}
add_shortcode('register_form', 'rc_register_form_shortcode');

---

function rc_restrict_shortcode($atts, $content = null) {
    $atts = shortcode_atts(array(
        'message' => '',
        // other attributes
    ), $atts);

    // Vulnerable: Attribute 'message' used directly in output without escaping
    if (!rc_is_restricted()) {
        return $content;
    } else {
        return '<p class="restriction-msg">' . $atts['message'] . '</p>';
    }
}
add_shortcode('restrict', 'rc_restrict_shortcode');

--- a/includes/shortcodes.php
+++ b/includes/shortcodes.php
@@ -10,7 +10,7 @@
     ), $atts);
 
-    return '<div id="' . $atts['id'] . '" class="' . $atts['class'] . '">...</div>';
+    return '<div id="' . esc_attr($atts['id']) . '" class="' . esc_attr($atts['class']) . '">...</div>';
 }
 
@@ -25,5 +25,5 @@
     } else {
-        return '<p class="restriction-msg">' . $atts['message'] . '</p>';
+        return '<p class="restriction-msg">' . wp_kses_post($atts['message']) . '</p>';
     }
 }