Patterns Kit <= 1.0.3 – Contributor+ Stored XSS via YouTube Popup Link | CVE 2026-15249

Description

The plugin does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.

Proof of Concept

Prerequisites:
- Patterns Kit active (a play-button / video-popup pattern ships with the plugin, e.g. "Play Icon" or "About Us #3 (Video)").
- The attacker holds a Contributor account (the lowest role that can author content the plugin renders). The victim is any user who later views and clicks the play button, e.g. an Editor/Administrator reviewing the Contributor's pending post.

Steps:
1. As the Contributor, create a post and insert a Patterns Kit pattern that renders a play button.
2. Switch to the Code Editor and change the play-button anchor to:

   <a href="' onload='alert(document.domain)'">P</a>

3. Submit the post for review (Pending).
4. As an Editor or Administrator, preview/open the post and click the play button.
5. alert(document.domain) executes in the reviewer's session.

Note: this works even though the Contributor lacks unfiltered_html. The href is stored as a benign entity-encoded relative URL that passes wp_kses; the browser decodes it back and the plugin's front-end script re-parses it into a new HTML context (an iframe src), where the single-quote breakout adds a live onload handler.