Executive Summary

The vulnerability exists in the Coachific Shortcode plugin for WordPress, specifically in the 'userhash' shortcode attribute. It is a Stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping.

Although the plugin uses sanitize_text_field() to strip HTML tags from the 'userhash' parameter, it does not escape characters that are significant in JavaScript strings, such as double quotes, semicolons, and parentheses.

The sanitized value is then directly inserted into a JavaScript string inside a <script> tag without proper JavaScript-specific escaping methods like wp_json_encode() or esc_js(). This allows attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users visit the affected pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow authenticated attackers with Contributor-level access or above to inject malicious JavaScript code into pages on the affected WordPress site.

When other users access these pages, the injected scripts will execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.

Because the attack is stored, the malicious code persists on the site and affects all users who view the compromised content.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update or remove the Coachific Shortcode plugin for WordPress if it is at version 1.0 or below, as these versions are vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute.

Additionally, restrict Contributor-level and higher user access until the vulnerability is addressed, since authenticated users with these privileges can exploit this issue.

Ensure that any input sanitization and output escaping for the 'userhash' parameter uses proper JavaScript-specific escaping functions such as wp_json_encode() or esc_js() to prevent script injection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'userhash' shortcode attribute in the Coachific Shortcode WordPress plugin. Detection typically involves identifying if the vulnerable plugin version is installed and if the 'userhash' shortcode is used in posts or pages.

To detect exploitation attempts or presence of the vulnerability on your system, you can search for usage of the 'userhash' shortcode in your WordPress content and check for suspicious script injections.

• Use WP-CLI to search for the shortcode usage: wp post list --post_type=page,post --format=ids | xargs -d' ' -I % wp post get % --field=post_content | grep '\[userhash'
• Search your database directly for the shortcode usage: SELECT ID, post_content FROM wp_posts WHERE post_content LIKE '%[userhash%';
• Check for suspicious script tags or injected JavaScript in posts or pages that use the shortcode.

Network detection of exploitation attempts may involve monitoring HTTP requests for unusual parameters or payloads targeting the 'userhash' attribute, but specific commands for network detection are not provided in the available information.

Useful 0 Not Useful 0