Executive brief
The MIR blocks and shortcodes plugin for WordPress, which provides custom design elements for websites, contains a security flaw that allows users with contributor-level access to inject malicious scripts into pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on behalf of visitors or the theft of sensitive session information.
Technical details
The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the msc_stats() rendering function. Specifically, attributes such as 'title' and 'ready_animation_text' within the 'msc_stats' shortcode do not properly neutralize user-supplied data. An authenticated attacker with contributor-level permissions or higher can exploit this by embedding malicious JavaScript into a post or page. When a victim views the page, the script executes within the context of their browser session, potentially allowing for session hijacking or unauthorized administrative actions. The vulnerability exists in all versions up to and including 1.0.0.
Affected products
- mirsoftware MIR blocks and shortcodes <= 1.0.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/mir-blocks-and-shortcodes/trunk/frontend-templates/function/msc-stats.php
- https://plugins.trac.wordpress.org/browser/mir-blocks-and-shortcodes/trunk/frontend-templates/function/msc-stats.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d698be-fae6-4960-912a-1078ea407031?source=cve