Listen to this Post
The List Children plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.1. The flaw exists in the `list_children` shortcode due to insufficient sanitization of user-supplied attributes. Attackers with contributor-level access or higher can inject malicious JavaScript payloads into pages using this shortcode. When other users visit the compromised page, the script executes in their browser, potentially leading to session hijacking, defacement, or malware distribution. The vulnerability stems from improper output escaping when rendering shortcode attributes in the frontend.
DailyCVE Form:
Platform: WordPress
Version: ≤2.1
Vulnerability: Stored XSS
Severity: Medium
Date: 05/19/2025
What Undercode Say:
Exploitation:
1. Attacker logs in as Contributor+.
2. Injects payload via shortcode:
[list_children attribute="<script>alert(document.cookie)</script>"]
3. Victim views page, script executes.
Detection:
grep -r "list_children" /var/www/html/wp-content/plugins/list-children/
Mitigation:
1. Update to patched version.
2. Apply WAF rules blocking XSS patterns:
location ~ .php$ {
set $xss_check "";
if ($args ~ "<script.>") { set $xss_check "block"; }
if ($xss_check = "block") { return 403; }
}
Manual Patch:
Edit plugin’s shortcode handler:
function handle_shortcode($atts) {
$clean_atts = array();
foreach ($atts as $key => $value) {
$clean_atts[$key] = esc_attr($value); // Sanitize output
}
// Rest of function
}
Verification:
curl -s http://target/wp-content/plugins/list-children/ | grep -q "Version: 2.1" && echo "Vulnerable"
References:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
