CVE-2017-6804 in WP Markdown Editor Plugin
Summary
by MITRE
A Stored XSS Vulnerability exists in the WP Markdown Editor (aka wp-markdown-editor) plugin 2.0.3 for WordPress. An example attack vector is a crafted IMG element in Add New Post or Edit Post.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The stored cross-site scripting vulnerability in the WP Markdown Editor plugin version 2.0.3 represents a critical security flaw that allows attackers to inject malicious scripts into WordPress posts through crafted markdown content. This vulnerability specifically manifests when users create or edit posts containing specially crafted img elements that trigger XSS payloads during rendering. The issue stems from insufficient input validation and output sanitization within the plugin's markdown processing functionality, creating an environment where attacker-controlled content can be executed in the context of authenticated users' browsers.
The technical implementation of this vulnerability occurs at the plugin level where markdown content is processed and rendered without proper sanitization of img src attributes. When a user creates or edits a post containing malicious img tags with javascript: protocols or data URIs in their source attributes, the plugin fails to adequately filter these elements before storage in the database. During subsequent post rendering, the unfiltered content executes within users' browsers, potentially leading to session hijacking, credential theft, or arbitrary code execution. This stored nature of the vulnerability means that victims need only view the affected post to be compromised, making it particularly dangerous for high-privilege users who may have access to sensitive administrative functions.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to establish persistent footholds within WordPress environments. An attacker could craft posts containing malicious scripts that steal admin session cookies, redirect users to phishing sites, or even inject additional malware payloads. The vulnerability affects all users who can create or edit posts, including contributors and editors, making it particularly concerning for multi-user WordPress installations where content moderation is essential. Given that the vulnerability exists in a widely used plugin, the potential attack surface is extensive across numerous WordPress deployments.
Mitigation strategies should focus on immediate patching of the affected plugin to version 2.0.4 or later, which includes proper input validation and output sanitization measures. Administrators should also implement content security policies to restrict script execution within the WordPress environment, particularly for user-generated content. Regular security audits of installed plugins and themes are essential to identify similar vulnerabilities, while implementing proper input validation frameworks such as those recommended by the OWASP Top Ten project can prevent future occurrences. The vulnerability aligns with CWE-79 Cross-site Scripting and maps to ATT&CK technique T1566 Phishing within the broader attack chain, representing a classic vector for initial access and privilege escalation in WordPress environments where administrative privileges are targeted.