WordPress Woody Code Snippets Cross-Site Scripting (XSS) Scanner

WordPress Woody Code Snippets is a popular plugin used by site administrators and developers to insert custom PHP, HTML, or JavaScript snippets directly into their WordPress sites. It allows users to manage and execute code snippets from the admin dashboard, providing a centralized way to add functionality without modifying theme files. This plugin is widely adopted for its ease of use and flexibility, enabling tasks like customizing site behavior or integrating third-party services.

Cross-Site Scripting (XSS) is a security vulnerability that occurs when an application includes untrusted data in a web page without proper validation or escaping. In the context of Woody Code Snippets, the vulnerability arises from insufficient sanitization of user-supplied input when creating or editing code snippets. This allows an attacker to inject malicious scripts that are then executed in the browsers of other users who view the affected pages.

The vulnerability specifically affects the snippet content input field within the plugin's admin interface. When a user with administrative privileges creates a new snippet or edits an existing one, the plugin fails to properly escape or validate the input before storing it. As a result, an attacker can inject JavaScript code into the snippet content, which will be executed when another admin accesses the snippet list or edit page.

If exploited, an attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement of the admin interface, theft of sensitive data such as login credentials, or further compromise of the WordPress site. The CVSS score of 7.2 indicates a high severity, making it critical to address this vulnerability promptly.