Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode

Vulnerability

The Product Slider for WooCommerce WordPress plugin before version 2.6.4 fails to validate and escape some of its shortcode attributes before outputting them back in the page. This allows stored cross-site scripting. The vulnerability is present in all versions prior to the fix.

Exploitation

An attacker with a role as low as Contributor can inject arbitrary JavaScript into shortcode attributes. When the shortcode is rendered on a page viewed by higher-privilege users (such as admins), the malicious script executes. The stored XSS is triggered in the context of the victim's session.

Impact

Successful exploitation can lead to disclosure of sensitive information, session hijacking, or actions performed on behalf of the admin user. This can compromise the entire WordPress site, including the ability to create new admin accounts or inject backdoors.

Mitigation

The vulnerability is fixed in version 2.6.4 of the plugin. Administrators should update to this version or later immediately. No workarounds are documented. The plugin vendor has released the patch on December 28, 2022 [1].