XSS in WordPress: From Zero to Master

What Is XSS?

XSS allows attackers to inject malicious JavaScript into your website. This script runs in the victim’s browser and can:

• Steal cookies or local storage data
• Hijack sessions
• Deface pages
• Perform unauthorized actions using the victim’s account
• Inject phishing or malware content

Common Types of XSS

• Stored XSS: The malicious payload is saved in the database and executed whenever a user views the affected page.
• Reflected XSS: The payload appears in the URL and is reflected back to the browser without being stored.
• DOM XSS: The vulnerability exists entirely in JavaScript, manipulating the DOM without server-side interaction.

Why XSS Is Extremely Dangerous in WordPress

WordPress websites often have logged-in admins performing tasks. A simple XSS executed in an admin session can:

• Create a new admin account for the attacker
• Install backdoor plugins
• Modify theme files
• Inject spam links or crypto miners

Because of this, XSS is often considered more dangerous than SQL injection in WordPress.

Examples of XSS Vulnerabilities in WordPress

1. Echoing User Input Without Escaping

<?php
// Vulnerable example
echo $_GET['name'];

2. Printing Data from the Database Without Sanitization

<?php
// Vulnerable example
echo get_option( 'my_custom_title' );

How to Escape Output Correctly in WordPress

WordPress provides built-in escaping functions. Use the correct one for the correct context:

• esc_html() – escape for HTML content
• esc_attr() – escape inside HTML attributes
• esc_url() – escape URLs
• esc_js() – escape for JavaScript contexts
• wp_kses() – allowlisted HTML only

Examples: Safe WordPress Code

1. Safe HTML Output

<?php
echo esc_html( $_GET['name'] );

2. Safe Attribute Output

<input type="text" value="<?php echo esc_attr( $value ); ?>">

3. Safe URL Output

<a href="<?php echo esc_url( $url ); ?>">Visit</a>

Using wp_kses() for Controlled HTML Output

If your feature allows user-submitted HTML (e.g., a custom field), use wp_kses() to filter it:

<?php
$allowed = array(
    'strong' => array(),
    'em'     => array(),
    'a'      => array( 'href' => array(), 'target' => array() )
);

echo wp_kses( $input, $allowed );

DOM XSS in WordPress

DOM XSS happens in JavaScript, for example:

// Vulnerable JS
document.getElementById('box').innerHTML = location.hash.substring(1);

Fix by using textContent instead:

document.getElementById('box').textContent = location.hash.substring(1);

How Attackers Usually Exploit XSS in WordPress

• Injecting scripts into post titles or custom fields
• Embedding payloads inside comment forms
• Abusing unescaped admin notices
• Exploiting vulnerable plugin settings pages
• Using URLs to trigger reflected XSS on search pages or filters

XSS Protection Checklist for WordPress Developers

• Escape everything before outputting
• Sanitize everything before saving
• Use the correct escaping function for the correct context
• Never trust user input (even from logged-in users)
• Disable unneeded HTML inputs
• Use nonces to prevent CSRF paired with XSS exploit paths
• Avoid using innerHTML in JavaScript unless absolutely needed

Secure Data Flow Model (The WordPress Way)

User Input → sanitize_*() → save → retrieve → esc_*() → output

Practical Real-World Examples

• XSS in comments due to unescaped author names
• XSS in shortcode attributes
• XSS in AJAX responses returning raw HTML
• XSS in custom Gutenberg meta fields

Advanced XSS Defenses

• Content Security Policy (CSP)
• SameSite cookies to block cross-origin attacks
• Strict sanitization of custom fields
• Filtering HTML with server-side allowlists
• Escaping dynamically generated JSON safely

Safe JSON Output

<script>
    const data = JSON.parse('<?php echo wp_json_encode( $data ); ?>');
</script>

Conclusion

XSS is one of the most dangerous and widespread vulnerabilities in WordPress. Mastering escaping, sanitization, and proper output handling is essential for all plugin and theme developers. By following the right WordPress functions and avoiding insecure JavaScript patterns, you can eliminate over 90% of XSS issues before they ever reach production.