Executive brief
A WordPress plugin used for displaying service details in grids or columns contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other visitors view the affected page, potentially leading to unauthorized actions or data theft. This could compromise the integrity of the website and the security of its visitors.
Technical details
The Services Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'link' Block Attribute in all versions up to and including 1.4.4. The vulnerability stems from insufficient input sanitization and output escaping, allowing the payload to persist inside HTML comments in post_content and bypass wp_kses_post sanitization during the save process. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute when a user accesses the page. The execution occurs via the primary service link anchor or a secondary title-wrapped anchor when the 'linkIn' option is set to 'title'. A patch has been released in subsequent versions.
Affected products
- bplugins Services Section Block – Showcase Service Details in Grid or Columns <= 1.4.4
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/services-section/trunk/build/service/render.php
- https://plugins.trac.wordpress.org/browser/services-section/trunk/build/service/view.js
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3570724%40services-section&new=3570724%40services-section&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e796458-acd4-4334-af1c-29c82f0791ac?source=cve