CVE-2026-109385 in UiChemy Plugin
Summary
by MITRE • 10/28/2026
The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in UiChemy versions up to and including 5.3.0 represents a significant security risk within WordPress ecosystems that utilize this plugin for converting design assets into editable content structures. The core technical flaw stems from insufficient input sanitization and output escaping mechanisms applied specifically to the actions[save_builder][data][elements][...][settings][slot_{N}_link][url] parameter. This specific data path is involved in processing link configurations within builder elements, where user-supplied values are accepted without adequate validation against malicious script injection patterns. The lack of proper encoding or filtering allows an attacker to inject arbitrary JavaScript code directly into the stored content structure, which persists on the server side until manually removed by a site administrator.
This vulnerability is classified as Stored Cross-Site Scripting, also known as Persistent XSS, under Common Weakness Enumeration standard CWE-79. Unlike reflected XSS attacks that require immediate user interaction with a crafted URL, this flaw embeds malicious scripts within legitimate-looking content structures such as posts or pages created by contributors. The operational impact is severe because the payload does not execute automatically upon page load but rather triggers conditionally when a specific event occurs. Specifically, the injected javascript: protocol handler activates only when a user clicks on the compromised link element while reviewing or previewing the post. This conditional execution model makes detection more difficult for automated security scanners that typically look for immediate script execution during initial page rendering.
The exploitation of this vulnerability requires authenticated access with at least contributor-level privileges, which limits the attack surface to internal users rather than unauthenticated external attackers. However, in many WordPress environments, contributors are trusted enough to create and submit content for publication or review by higher-privileged roles such as Editors or Administrators. The critical phase of exploitation occurs when these privileged users interact with the injected link during their routine workflow activities. When an Editor or Administrator clicks the malicious link while previewing the contributor's submission, the browser executes the embedded JavaScript payload within the context of the victim’s session. This can lead to account hijacking through cookie theft, redirection to phishing sites, defacement of the website interface, or further propagation of malware if the script attempts to load external payloads from remote servers.
From a threat intelligence perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Initial Access and Execution phases, particularly those involving social engineering through trusted content workflows. The attacker leverages the trust relationship between contributors and editors/administrators to bypass typical perimeter defenses that focus on external threats. Once executed, the script operates within the same origin policy as the WordPress dashboard or frontend interface, granting it full access to DOM elements, local storage, and session cookies associated with the victim’s active login state. This capability enables attackers to perform actions such as changing user passwords, creating new administrative accounts, or exfiltrating sensitive data stored in browser memory without triggering immediate alarms due to its origin from a legitimate domain.
Mitigation strategies must address both the technical flaw and the procedural aspects of content management within WordPress environments. Immediate remediation involves upgrading the UiChemy plugin to version 5.3.1 or later, where developers have implemented proper input sanitization using functions like wp_kses_post or similar escaping mechanisms for URL parameters before storage in the database. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations include restricting contributor-level access to only trusted individuals and enforcing strict review processes where editors manually inspect all link attributes before publishing. Additionally, implementing a Content Security Policy header can help mitigate the impact of successful XSS attacks by restricting script execution sources and preventing inline scripts from running unless explicitly whitelisted.
Long-term security posture improvements should include regular auditing of plugin code for proper sanitization practices across all input vectors, particularly those handling URLs or HTML attributes that are rendered in interactive contexts. Security teams should also consider deploying Web Application Firewalls configured to detect patterns consistent with javascript: protocol injections and other XSS payloads within POST request bodies containing builder data structures. Training content creators on secure coding principles and awareness of social engineering tactics can further reduce the likelihood of successful exploitation by ensuring that suspicious links are not blindly clicked during routine review processes. Continuous monitoring for anomalous behavior in user sessions, such as unexpected navigation patterns or high volumes of link clicks from specific IP ranges, can also aid in early detection of ongoing attacks leveraging this vulnerability.