EUVD-2026-23170
GHSA-63x8-x938-vx33
GHSA-7xjm-g8f4-rp26
GHSA-83mq-cmhp-6pvq
GHSA-ffq7-898w-9jc4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including, 0.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires comments to be enabled on the target post and guest comments to be allowed.
AnalysisAI
Stored Cross-Site Scripting (XSS) in CodeColorer plugin for WordPress versions up to 0.10.1 allows unauthenticated attackers to inject malicious JavaScript via the 'class' parameter in the 'cc' comment shortcode, which executes in the browsers of users viewing the affected page. Exploitation requires comments to be enabled and guest comments permitted on the target post. The vulnerability has a CVSS score of 6.1 with low complexity and no authentication required, but user interaction (visiting the affected page) is necessary for the payload to execute.
Technical ContextAI
CodeColorer is a WordPress plugin (CPE: cpe:2.3:a:kpumuk:codecolorer:*:*:*:*:*:*:*:*) that provides syntax highlighting functionality through shortcodes. The vulnerability exists in the 'cc' comment shortcode parser, which accepts a 'class' parameter intended for CSS styling. The plugin fails to properly sanitize this parameter before storing it in the database and fails to escape it when outputting to HTML, creating a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The shortcode is processed when comments are rendered, making stored payloads execute in the context of any page containing an infected comment when viewed by site visitors.
RemediationAI
Update the CodeColorer plugin to a patched version released after 0.10.1. The WordPress plugin repository changeset 3481552 indicates a fix is available in the plugin's source code repository; administrators should update through the WordPress plugin management interface or directly from https://plugins.trac.wordpress.org/changeset/3481552/codecolorer. If immediate patching is not possible, disable the CodeColorer plugin until a patch is applied. As a temporary mitigation, disable guest comments on all posts or globally through Settings > Discussion, which prevents unauthenticated attackers from injecting payloads, though this impacts legitimate user engagement. Additionally, review existing comments for suspicious 'class' parameter values in 'cc' shortcodes and delete any that contain angle brackets, quotes, or event handlers (e.g., onclick, onerror). Website administrators can audit for exploitation by searching the database for comment content containing [cc class= followed by suspicious characters or JavaScript keywords.
More in Codecolorer
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today