Executive brief
The Content Mask WordPress plugin is a tool that allows website administrators to display content from other sources within their posts. Before version 1.8.5.6, the plugin fails to properly sanitize and escape user-submitted content, allowing contributors and other low-privileged users to inject malicious scripts that execute when administrators, editors, or visitors view the affected post. This could lead to account compromise, session hijacking, or defacement.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw (CWE-79) in the Content Mask WordPress plugin versions 1.7.1 through 1.8.5.5. The plugin fails to sanitize and escape content in the "Header Scripts & Styles" and "Footer Scripts & Styles" fields before outputting it in generated pages. Any user with Contributor role or higher can inject malicious payloads (e.g., <img src=x onerror=alert(document.domain)>) via the post editor's Content Mask metabox. When administrators preview or publish the post, the injected script executes in their session. The role-restriction option does not prevent this attack. The vulnerability is fixed in version 1.8.5.6.
Affected products
- WordPress Content Mask 1.7.1 to 1.8.5.5
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 1.8.5.6