Executive brief
The WP Blockade plugin for WordPress is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. This occurs when a logged-in user is tricked into clicking a specially crafted link. If successful, an attacker could potentially steal session information or perform unauthorized actions on behalf of the victim.
Technical details
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'shortcode' parameter in the render_shortcode_preview() function. The vulnerability exists because the function takes user input from $_GET['shortcode'], processes it with stripslashes(), and echoes it using do_shortcode() without proper sanitization or escaping. If the input is not a valid shortcode, it is reflected directly into the page. The affected endpoint is registered via admin_post_, requiring at least Subscriber-level authentication, but lacks nonce verification or capability checks. Attackers can exploit this by tricking an authenticated user into clicking a malicious link to execute arbitrary JavaScript in their browser session.
Affected products
- WP Blockade WP Blockade Up to and including 0.9.14
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php
- https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/66950509-ce2a-42fe-a8b2-2a92a1b573c3?source=cve