WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode

Vulnerability

The WPZOOM Portfolio WordPress plugin before version 1.2.2 fails to validate and escape one of its shortcode attributes. This flaw enables a stored Cross-Site Scripting (XSS) attack. The plugin uses shortcodes that accept attributes, and the vulnerable attribute is not sanitized before being output, allowing arbitrary HTML and JavaScript to be embedded. The required condition is that the plugin must be installed and active, and a user with the contributor role or higher must be able to add or edit posts that process the shortcode. Versions prior to 1.2.2 are affected [1].

Exploitation

An attacker with a contributor-level account (the lowest authoring role) can craft a post or page containing the vulnerable shortcode with a malicious attribute value containing JavaScript. When the post is viewed by another user, the injected script executes within the context of the victim's browser. No additional user interaction beyond viewing the affected page is needed. The researcher Lana Codes provided a proof of concept [1].

Impact

Successful exploitation leads to stored XSS, enabling the attacker to execute arbitrary JavaScript in the browsers of users visiting the compromised page. This can result in session hijacking, defacement, theft of sensitive data, or redirection to malicious sites. The attack operates within the privileges of the victim's session, potentially affecting administrators and other high-privilege users.

Mitigation

The vulnerability is fixed in version 1.2.2 of the WPZOOM Portfolio plugin, released as of the public disclosure date on 2022-12-28 [1]. Users should update to version 1.2.2 or later immediately. No workarounds are documented; upgrading to the patched version is the sole mitigation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.