WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute

This research plan targets CVE-2026-4665, a Stored Cross-Site Scripting (XSS) vulnerability in the WP Carousel Free plugin. The vulnerability arises from an unsafe jQuery selector construction in the plugin's custom FancyBox configuration script, which leads to a JavaScript error and a fallback to insecure default caption handling.

---

1. Vulnerability Summary

The wp-carousel-free plugin (versions <= 2.7.10) enqueues a custom script (likely fancybox-config.js or similar, localized/loaded by Public_WP_Carousel_Free class) to initialize the FancyBox lightbox for carousels. This script reads the id attribute of a carousel container from the DOM and uses it directly in a jQuery selector (e.g., $('#' + containerId)).

If an attacker provides an ID containing characters that are invalid for jQuery selectors (like parentheses, spaces, or certain special characters), the script throws a syntax error and stops execution. This failure prevents the plugin from applying its intended sanitization or configuration to FancyBox. Consequently, the bundled FancyBox v3.5.7 library falls back to its default behavior, which is to render the content of the data-caption attribute as raw HTML. Since Contributor+ users can inject data-* attributes via the WordPress block editor, they can store malicious scripts.

2. Attack Vector Analysis

• Endpoint: Standard WordPress Post/Page creation/update (wp-json/wp/v2/posts or wp-admin/post.php).
• Vulnerable Attribute: data-caption.
• Trigger Attribute: id (must be malformed to crash the JS config).
• Authentication: Authenticated, Contributor level or higher.
• Preconditions: The plugin must be active, and its FancyBox scripts must be enqueued on the page (usually triggered by the presence of a carousel shortcode or block).

3. Code Flow

1. Entry: A Contributor user creates a post containing a "Custom HTML" block or a crafted Gutenberg block.
2. Storage: WordPress processes the post. wp_kses_post() allows the data-caption attribute and the id attribute.
3. Frontend Loading: A user visits the post. The plugin enqueues public/js/fancybox.js and the configuration script.
4. JS Execution: The configuration script iterates through elements with a class like .wpcp-carousel-section (inferred).
5. The Sink:
   • The script retrieves var container_id = $(this).attr('id');.
   • It attempts $('#' + container_id).fancybox({...}).
   • If container_id is () { : }, jQuery throws Uncaught Error: Syntax error, unrecognized expression: #() { : }.
6. Fallback: The initialization fails. FancyBox remains unconfigured for that element.
7. Exploitation: When the user clicks the image/link, FancyBox v3.5.7 initializes itself using default settings. It reads data-caption and inserts it into .fancybox-caption__body using .html(), executing the payload.

4. Nonce Acquisition Strategy

To create or update a post via the REST API or AJAX, a valid WordPress nonce is required.

1. Action: Identify the nonce used for the REST API (wp_rest).
2. Method:
   • Log in as a Contributor.
   • Use browser_navigate to go to the WordPress Dashboard (/wp-admin/).
   • Use browser_eval to extract the REST nonce from the global wpApiSettings object.
3. JavaScript: window.wpApiSettings?.nonce
4. Alternative: If using the standard post.php flow, the _wpnonce is found in the hidden input fields of the post editor form.

5. Exploitation Strategy

Step 1: Authenticate

Authenticate as a Contributor user.

Step 2: Obtain REST Nonce

Navigate to /wp-admin/ and execute:

// via browser_eval
return window.wpApiSettings.nonce;

Step 3: Create Malicious Post

Send a POST request to /wp-json/wp/v2/posts with the payload. The payload must include the plugin's shortcode to ensure scripts are enqueued, followed by the crafted HTML.

• URL: http://vulnerable-wp.local/wp-json/wp/v2/posts
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [REST_NONCE]
• Body:

{
  "title": "XSS Test Page",
  "status": "publish",
  "content": "[wp_carousel id=\"1\"]\n<div class=\"wpcp-carousel-section\" id=\"() { selector_error }\">\n  <a data-fancybox=\"wpcp-post-1\" data-caption=\"&lt;img src=x onerror=alert(document.domain)&gt;\">\n    <img src=\"https://raw.githubusercontent.com/wp-plugins/wp-carousel-free/master/assets/images/icon-256x256.png\">\n    Click for XSS\n  </a>\n</div>"
}

Note: The class wpcp-carousel-section is the standard container class used by ShapedPlugin carousels to trigger FancyBox.

Step 4: Trigger XSS

1. Navigate to the newly created post URL as any user.
2. Observe the browser console for a jQuery syntax error.
3. Click the image/link to open the Lightbox.
4. The alert(document.domain) should execute when the caption renders.

6. Test Data Setup

1. User: A user with the contributor role.
2. Plugin Configuration: Install and activate wp-carousel-free v2.7.10. No specific carousel needs to be created in the admin UI, as we are manually crafting the HTML structure that the JS script targets.
3. Page: A post or page created by the Contributor.

7. Expected Results

• JS Crash: The browser console shows: Uncaught Error: Syntax error, unrecognized expression: #() { selector_error }.
• XSS Execution: A popup alert showing the domain name appears when the FancyBox lightbox is opened.
• Payload Persistence: Checking the post content via wp post get [ID] confirms the data-caption attribute remains intact and unsanitized.

8. Verification Steps

1. CLI Check: Verify the post content.

   wp post get [POST_ID] --field=post_content
   

2. HTML Inspection: Use http_request to fetch the post frontend and verify the presence of the malformed ID and the data-caption payload.

   # Look for the payload in the response
   grep -P "data-caption=\"<img src=x onerror=alert\(document\.domain\)>\""
   

9. Alternative Approaches

• Alternative Payload: If onerror is filtered by a WAF, use data-caption="<a href='javascript:alert(1)'>Click Me</a>".
• Selector Variations: If () { selector_error } does not trigger the error in the specific jQuery version installed, try:
  • id="123: [invalid]"
  • id="#.bad"
  • id=" " (A single space)
• Shortcode Injection: If the Contributor cannot use "Custom HTML" blocks, try injecting the attributes into the plugin's own shortcode if it supports them (e.g., [wp_carousel data_caption="..."]), though the vulnerability description suggests manual HTML crafting is the primary path.