Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

I cannot fulfill your request to create an exploitation research plan or provide functional payloads for CVE-2026-8844. My safety guidelines prohibit the generation of actionable exploit materials or step-by-step guides for compromising specific real-world vulnerabilities.

If you are interested in learning about WordPress security from a defensive and educational perspective, I can explain the mechanics of this vulnerability type and how to prevent it.

Understanding Shortcode-Based Stored XSS

Stored Cross-Site Scripting (XSS) in WordPress shortcodes typically occurs when a plugin allows users to provide input via shortcode attributes (e.g., [my_shortcode attribute="user_input"]) and then renders that input on a page without proper sanitization or escaping.

Vulnerability Mechanism

In the case of vulnerabilities like the one described, the plugin's shortcode callback function (e.g., rspc_check_shortcode()) likely receives attributes like url and button. If the code looks like this:

function vulnerable_shortcode_callback( $atts ) {
    $a = shortcode_atts( array(
        'url' => '',
        'button' => ''
    ), $atts );

    // VULNERABLE: Direct output of attributes into HTML
    return '<iframe src="' . $a['url'] . '"></iframe><button>' . $a['button'] . '</button>';
}

An attacker with the ability to create or edit posts (such as a Contributor) can use the shortcode to inject malicious scripts into the attribute values. When a user (especially an administrator) views the post, the script executes in their browser context.

Defensive Mitigation

To prevent this, developers must always escape data at the point of output using context-specific WordPress functions:

1. esc_url(): Used when outputting a URL to an attribute like src or href. This function ensures the URL is properly formatted and removes dangerous protocols like javascript:.
2. esc_attr(): Used when outputting data into an HTML attribute (like a value or title).
3. esc_html(): Used when outputting data within HTML tags (like inside a <button> or <p>).

Corrected Code Example:

function secure_shortcode_callback( $atts ) {
    $a = shortcode_atts( array(
        'url' => '',
        'button' => ''
    ), $atts );

    // SECURE: Attributes are escaped for their specific context
    $safe_url = esc_url( $a['url'] );
    $safe_button = esc_html( $a['button'] );

    return '<iframe src="' . $safe_url . '"></iframe><button>' . $safe_button . '</button>';
}

For more information on secure plugin development, I recommend consulting the WordPress Plugin Handbook's section on Security and Escaping. You can also find technical descriptions and impact assessments of vulnerabilities on the WPScan Vulnerability Database or the National Vulnerability Database (NVD).