WordPress Code Embed Stored XSS via External URL Embedding (CVSS 6.5)

Vulnerability Overview Code Embed versions 2.6 and below contain a stored Cross-Site Scripting (XSS) vulnerability, exploitable via the external URL embedding feature within post content. This vulnerability allows contributors to submit posts containing malicious URLs, causing malicious JavaScript code to execute in the browsers of administrators or editors when they preview or review the posts. Impact Scope Affected Versions: Code Embed 2.6 and below Fixed Versions: 2.6.1 Severity: Medium (6.5/10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: Low Remediation 1. Require capability: Before expanding external URL embeds, require the user to have the capability, or sanitize the fetched remote response before inserting it into the post content. 2. Apply fix code: In the file, within the function, apply the fix after returns the remote response. 3. Store user capabilities: When saving content, store whether the post author has the capability. If the user does not have this capability, do not expand URL embeds. POC Code Exploitation Steps 1. Environment Setup: - WordPress: 6.9.4 - Plugin: Code Embed 2.6 - Dependencies: None - Attacker Role: Contributor - Victim Role: Administrator or Editor 2. Administrator Setup: - Log in to WordPress as an administrator. - Install and activate Code Embed version 2.6. - Create or confirm the existence of a user with the Contributor role. 3. Attacker Setup: - Create the following file on an HTTPS host controlled by the attacker: - Provide this response body. 4. Quick Test URL: - If the reviewer does not wish to host the file, this public endpoint currently returns the same response body generated by decoding the base64 path. 5. Attacker Steps: - Log in as a Contributor. - Open . - Set the post title to "Code Embed Remote XSS Review". - Add the following post content: - Or, for the public quick test endpoint: - Click Submit for Review. - Log in as an Administrator or Editor. - Open the pending post preview/view page. - The browser executes the injected image error handler and displays an alert dialog. Expected Vulnerability Output Browser Display Local Rendering Verification Generated using the public URL: Generated using simulated HTTP response: Negative Control When Code Embed is not active, URL tokens remain as text and do not execute. If the remote file returns safe text such as , JavaScript is not executed. If the remote response body is sanitized using or if URL embeds are restricted to users with the capability, posts submitted by Contributors will no longer execute the payload. Impact Contributors can submit pending posts containing attacker-controlled JavaScript, which executes when an Administrator or Editor previews/views the post. The script runs within the victim user's same-origin WordPress session. Confidentiality Impact: Low - Same-origin JavaScript can read page content and non-HttpOnly data. Integrity Impact: Low - Same-origin JavaScript can perform actions authorized by the victim, unrestricted by the same-origin policy. Availability Impact: Low - The script can interrupt the execution of the victim's browser page/session.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Code Embed Stored XSS via External URL Embedding (CVSS 6.5)

More from this source