Executive brief
WP Highlight Box is a WordPress plugin used to display highlighted content boxes. The plugin fails to properly escape user input in shortcode attributes, allowing users with contributor-level access and higher to inject malicious scripts that are stored in pages and executed for all site visitors, potentially compromising user accounts and site integrity.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the WP Highlight Box plugin version 1.0 and earlier, caused by insufficient output escaping of shortcode attributes before rendering them in page content. The vulnerable component is the highlight-box shortcode handler. An authenticated attacker with contributor role or above can embed malicious JavaScript in shortcode attributes, which is then stored in the page and executed in the browsers of all users who view that page. No patch is currently available according to WPScan. Exploitation requires the attacker to have WordPress user account privileges at the contributor level or higher.
Affected products
- WP Highlight Box WP Highlight Box through 1.0
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory