Executive brief
The hk_shortcode plugin for WordPress, which provides custom formatting tools for website content, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. This vulnerability impacts all versions of the plugin up to and including version 1.0.
Technical details
The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the huankong_post_short_title_plane() function. Specifically, the 'title' attribute of the 'title-plane' shortcode is concatenated directly into the HTML output without being escaped. An authenticated attacker with contributor-level permissions or higher can exploit this by creating a post containing a malicious shortcode. When other users, including administrators, view the page, the injected script will execute in their browser session. This vulnerability exists in versions up to and including 1.0.
Affected products
- huankong hk_shortcode up to, and including, 1.0
Timeline
- 2026-05-27: disclosed: Initial publication of the vulnerability advisory.
- 2026-05-27: advisory: Wordfence published the vulnerability details.