Authenticated (Contributor) Stored XSS in “IDE Micro code-editor” — What Every Site Owner Needs to Know

Date: 10 February 2026
Author: Hong Kong Security Expert

Summary: A stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin “IDE Micro code-editor” (versions ≤ 1.0.0) allows an authenticated contributor to inject malicious JavaScript via the shortcode title attribute. Although scored with relatively low priority, the issue can be weaponised to target administrators, editors, and site visitors. This article explains the vulnerability, exploitation methods, detection and remediation steps, short-term virtual patching guidance, secure coding practices, incident response actions, and operational hardening measures.

What happened? A plain-English summary

The plugin registers a shortcode (commonly named along the lines of ide_micro) that accepts a title attribute. The plugin processes that attribute and outputs it without proper sanitisation or escaping. A user with the Contributor role can craft a post containing the vulnerable shortcode and include script content in the title attribute. When an editor, administrator, or a visitor views the page or a preview that renders that shortcode, the stored script runs in their browser context.

Because contributors can create drafts and submit content for review, stored XSS becomes a vehicle to reach higher-privileged users who subsequently view the poisoned content. This can lead to session theft, privilege escalation, content tampering, and broader compromise.

Why this matters: the real-world impact of stored XSS

Stored XSS is particularly dangerous because malicious code is persisted on the site and can be executed repeatedly. Real-world impacts include:

• Session theft and account takeover if session cookies or tokens are exposed.
• Privilege escalation through actions performed in the context of an admin/editor’s browser.
• Reputation harm or distribution of malicious content to site visitors.
• Credential harvesting via deceptive dialogs or forms presented to privileged users.
• Silent redirection, content injection, or loading of cryptomining scripts on visitor browsers.

Vulnerability technical details (how the issue works)

At a technical level, the plugin accepts shortcode attributes and outputs them directly into HTML without contextual escaping. Example payload an attacker might use:

[ide_micro title=""]

If the shortcode rendering function echoes or returns this attribute into the page without escaping (for example, omitting esc_attr() when placing a value inside a HTML attribute), the script executes in any viewer’s browser who loads that content.

Common root causes:

• Missing sanitisation of shortcode attributes (no sanitize_text_field(), wp_kses(), etc.).
• Directly echoing untrusted values into HTML output.
• Assuming Contributor role provides safe input (it does not).
• Rendering shortcodes in contexts viewed by privileged users (editor previews, admin list screens).

A typical CVSS/CWE-style assessment for this class of bug: low attack complexity, low privileges required (Contributor), user interaction required (an editor/admin must view the content), and potential scope change where the impact crosses to higher-privileged contexts.

Exploitation scenarios (real attacker playbook)

1. Create a new post or edit an existing draft in the WordPress editor.
2. Insert the vulnerable shortcode and place a crafted JavaScript payload in the title attribute.
3. Save as draft or submit for review; the content is now stored in the database.
4. An editor or administrator previews or opens the draft; the stored script executes in their browser.
5. The script can exfiltrate cookies, take administrative actions via logged-in requests, create new accounts, or inject further malicious content.

Alternate vectors include public rendering of the shortcode on front-end pages (impacting all visitors) or sharing of preview links that cause execution for anyone who opens them.

Detecting if you’re affected (queries, scans, and indicators)

Check for the plugin and scan content for the shortcode and inline scripts. Key checks:

1. Confirm plugin installation and version via the Plugins dashboard or by inspecting the filesystem for a directory such as wp-content/plugins/ide-micro-code-editor/.
2. Search posts for the shortcode. Example using WP-CLI:

wp post list --post_type=post,page --format=ids | xargs -n1 -I % wp post get % --field=post_content | grep -n --color -E '\[(ide[_-]?micro|ide-micro)[^]]*title\s*=\s*("|\')'

3. Use SQL to find posts that include the shortcode:

SELECT ID, post_title FROM wp_posts
WHERE post_content LIKE '%[ide_micro%' OR post_content LIKE '%[ide-micro%';

4. Look for in post content or postmeta:

SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

SecRule REQUEST_BODY "@rx \[(?:ide[_-]?micro|ide-micro)[^\]]*title\s*=\s*(['"]).*?(