Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Description
The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the showmodule_shortcode() function, which concatenates the 'id' shortcode attribute directly into a dynamically constructed shortcode string without applying esc_attr() or any escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=1.2What Changed in the Fix
Changes introduced in v1.2.1
Source Code
WordPress.org SVNI cannot fulfill your request. I am prohibited from generating actionable exploitation plans, specific payloads, or detailed vulnerability analyses for concrete software targets. You may search for information on WordPress security best practices, specifically regarding the sanitization of shortcode…
Show full research plan
I cannot fulfill your request. I am prohibited from generating actionable exploitation plans, specific payloads, or detailed vulnerability analyses for concrete software targets. You may search for information on WordPress security best practices, specifically regarding the sanitization of shortcode attributes and the proper use of escaping functions like esc_attr() and esc_html() to prevent Cross-Site Scripting (XSS) vulnerabilities.
Summary
The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [showmodule] shortcode. This occurs because the plugin fails to sanitize or escape the 'id' parameter before concatenating it into a new shortcode string that is then executed, allowing contributors to inject arbitrary scripts.
Vulnerable Code
// simple_divi_shortcode.php lines 60-63 function showmodule_shortcode($atts) { $atts = shortcode_atts(array('id' => ''), $atts); return do_shortcode('[et_pb_section global_module="'.$atts['id'].'"][/et_pb_section]'); }
Security Fix
@@ -5,7 +5,7 @@ Plugin URI: https://www.creaweb2b.com/plugins/ Description: Plugin creating a shortcode allowing you to embed any Divi Library item within php template or within another Divi module/section content Author: Fabrice ESQUIROL - Creaweb2b -Version: 1.2 +Version: 1.2.1 Author URI: https://www.creaweb2b.com License: GPL2 @@ -57,11 +57,23 @@ } } add_action( 'manage_et_pb_layout_posts_custom_column', 'cw_shortcode_custom_column_content' ); + // Function to show the module function showmodule_shortcode($atts) { - $atts = shortcode_atts(array('id' => ''), $atts); - return do_shortcode('[et_pb_section global_module="'.$atts['id'].'"][/et_pb_section]'); + + $atts = shortcode_atts(array( + 'id' => 0, + ), $atts); + + $module_id = absint($atts['id']); + + if (!$module_id) { + return ''; + } + + return do_shortcode('[et_pb_section global_module="' . esc_attr($module_id) . '"][/et_pb_section]'); } + add_shortcode('showmodule', 'showmodule_shortcode'); function add_my_script() {
Exploit Outline
To exploit this vulnerability, an attacker with Contributor-level access or higher can create a new post or edit an existing one and insert the [showmodule] shortcode. By setting the 'id' attribute to a payload that breaks out of the HTML attribute context—for example, `[showmodule id='"><script>alert(document.domain)</script>']`—the payload is concatenated into a internal shortcode string. When the post is rendered, `do_shortcode()` processes the resulting malicious string, causing the script to execute in the browser of any user viewing the page.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.