Wonder Video Embed < 1.8 - Contributor+ Stored XSS
Description
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Wonder Video Embeddescription
- Range: <1.8
Patches
Vulnerability mechanics
Root cause
"Missing output escaping of shortcode parameters in the wonderplugin_video shortcode allows stored cross-site scripting."
Attack vector
An attacker with a role as low as Contributor can inject arbitrary JavaScript into a WordPress post or page by embedding the `wonderplugin_video` shortcode with malicious payloads in its parameters. Because the plugin fails to escape shortcode parameters [CWE-79], the injected script is stored on the server and executed in the browser of any user who views the affected content. The attack requires only the ability to create or edit posts (Contributor-level access) and does not require any special network position beyond normal WordPress usage.
Affected code
The `wonderplugin_video` shortcode in the Wonder Video Embed plugin does not escape its parameters before output. The advisory does not specify the exact file or function name, but the vulnerable code is in the shortcode handler that processes and renders the shortcode attributes.
What the fix does
The advisory states the vulnerability is fixed in version 1.8 of the Wonder Video Embed plugin. The fix involves properly escaping the parameters of the `wonderplugin_video` shortcode before output, preventing injected HTML or JavaScript from being interpreted by the browser. No patch diff is available in the bundle, but the remediation guidance is to update to version 1.8 or later.
Preconditions
- authAttacker must have a WordPress account with at least Contributor role.
- configThe Wonder Video Embed plugin must be installed and active with a version prior to 1.8.
- inputAttacker must be able to create or edit posts/pages containing shortcodes.
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/67910e5d-ea93-418b-af81-c50d0e05d213mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.