Exploitation Research Plan - CVE-2026-0737

1. Vulnerability Summary

The Shortcodes Ultimate plugin (<= 7.4.7) is vulnerable to Stored Cross-Site Scripting (XSS) via the su_lightbox shortcode. The vulnerability exists because the plugin insufficiently sanitizes the src attribute. While it performs a weak check for the string javascript and uses esc_attr() on the output, it fails to account for:

1. Protocol Bypasses: Bypassing the javascript: check using data: URIs.
2. JavaScript Sink Injection: The frontend JavaScript (Magnific Popup) reads the data-mfp-src attribute and uses it to dynamically construct HTML elements (like <img> or <iframe>). During this process, attribute-escaped characters (like ") are interpreted as real quotes, allowing an attacker to break out of the constructed HTML tag's attributes.

2. Attack Vector Analysis

• Endpoint: Standard WordPress post/page creation/edition.
• Shortcode: [su_lightbox]
• Vulnerable Attribute: src
• Authentication Level: Authenticated (Contributor+). Contributors can create posts and use shortcodes by default.
• Preconditions: The su_option_unsafe_features setting is typically on by default, but this vulnerability persists regardless of that setting as it lies in the core shortcode rendering logic.

3. Code Flow

1. Entry Point: A user with Contributor+ permissions saves a post containing the [su_lightbox] shortcode.
2. Processing: When the post is rendered, WordPress calls do_shortcode(), which triggers the registered callback su_shortcode_lightbox in includes/shortcodes/lightbox.php.
3. Vulnerable Function: su_shortcode_lightbox($atts, $content)
   • Line 112: $atts['src'] = su_do_attribute($atts['src'], true); (Processes placeholders).
   • Line 114: if (strpos(strtolower($atts['src']), 'javascript') !== false) (Blacklist check for javascript: protocol).
   • Line 124: The src is passed to esc_attr() and embedded in a <span> tag:

     return '<span class="su-lightbox..." data-mfp-src="' . esc_attr($atts['src']) . '" ...>';
     

4. Frontend Execution:
   • The plugin enqueues magnific-popup and su-shortcodes (includes/js/su-shortcodes.js).
   • The JS initializes the lightbox on elements with class .su-lightbox.
   • When a user clicks the lightbox trigger, Magnific Popup reads the data-mfp-src value using jQuery's .data() or .attr().
   • Sink: Magnific Popup uses this value to construct the modal content. If type="image", it creates an <img> tag. If type="iframe", it creates an <iframe>. Because it often uses string concatenation or jQuery's $() to build these elements, the payload executes.

4. Nonce Acquisition Strategy

No WordPress nonce is required to exploit this vulnerability because it is a Stored XSS triggered by the standard rendering of post content.

• The shortcode is processed during the the_content filter execution.
• The Contributor only needs to create or update a post, which uses standard WordPress nonces for the post.php or post-new.php endpoints. These are managed automatically by a logged-in session.

5. Exploitation Strategy

Step-by-Step Plan

1. Login as Contributor: Authenticate with Contributor credentials.
2. Create Post: Use the WordPress REST API or standard post creation to save a post containing the malicious shortcode.
3. Inject Payload: Use a payload that bypasses the javascript check and breaks out of the JS-constructed attribute.

Malicious Payloads

Option A: Attribute Breakout (via Image type)
This payload uses a double quote to break out of the src attribute when Magnific Popup constructs the <img> tag.

[su_lightbox type="image" src='https://example.com/logo.png" onerror="alert(window.origin