Executive brief
The Responsive Check plugin for WordPress, which allows site owners to preview how their site looks on different devices, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. The vulnerability exists within the rspc_check_shortcode() function, which fails to perform adequate input sanitization and output escaping on the 'url' and 'button' shortcode attributes. These attributes are echoed directly into iframe src attributes without using protective functions like esc_attr() or esc_url(). This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts. The scripts are stored on the server and execute in the context of a user's browser session whenever they visit the compromised page.
Affected products
- WordPress Responsive Check (responsive-checker-real-time) Up to, and including, 0.0.3
Timeline
- 2026-05-27: disclosed: Advisory published by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/responsive-checker-real-time/trunk/responsive-check.php
- https://plugins.trac.wordpress.org/browser/responsive-checker-real-time/trunk/responsive-check.php
- https://plugins.trac.wordpress.org/browser/responsive-checker-real-time/trunk/responsive-check.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d571e3-cf6d-4e9b-a3d7-e7e19497b5a9?source=cve