Executive brief
The LiveJournal Shortcode WordPress plugin fails to properly validate and escape shortcode attribute values before displaying them on pages and posts. This allows contributors and higher-privileged users to inject malicious JavaScript code that executes when the page is viewed, potentially compromising website visitors' accounts or stealing sensitive information.
Technical details
The plugin contains a stored cross-site scripting (XSS) vulnerability in its shortcode processing. Specifically, it does not validate or escape shortcode attributes (such as the 'user' parameter) before outputting them back into page/post content. An attacker with contributor role or above can craft a malicious shortcode—for example, [lj user='"onmouseover="alert(1)"']—that injects unescaped HTML and JavaScript into the rendered page. This is a stored XSS flaw because the payload persists in the post/page content. The attack requires user authentication at the contributor level or higher; no fix version is currently available.
Affected products
- LiveJournal Shortcode LiveJournal Shortcode through 1.1.1
Timeline
- 2024-04-15: disclosed
- 2024-04-15: advisory