Executive brief
The Canvas plugin for WordPress, which provides design and layout tools for websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'tag' parameter within the block-section-heading component. This vulnerability allows authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts into the database. These scripts are then executed in the context of a user's browser whenever they navigate to the compromised page. The issue is present in all versions up to 2.5.2 and was addressed in version 2.5.3. The attack vector is network-based and requires low-level authentication but no user interaction from the victim beyond visiting the page.
Affected products
- Canvas Canvas Up to and including 2.5.2
Timeline
- 2026-06-13: disclosed
- 2026-06-13: advisory
References
- https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/components/basic-elements/block-section-heading/render.php
- https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/components/basic-elements/block-section-heading/render.php
- https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/gutenberg/custom-blocks/index.php
- https://plugins.trac.wordpress.org/changeset/3553553/canvas/trunk/components/basic-elements/block-section-heading/render.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fcanvas/tags/2.5.2&new_path=%2Fcanvas/tags/2.5.3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f93d70e4-01c5-44e8-b7d5-0837bee53b8d?source=cve