Collapse-O-Matic Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-7030| WordPress Plugin Vulnerability Report 

Plugin Name: Collapse-O-Matic

Key Information:

  • Software Type: Plugin
  • Software Slug: jquery-collapse-o-matic
  • Software Status: Active
  • Software Author: baden03
  • Software Downloads: 1,284,998
  • Active Installs: 50,000
  • Last Updated: May 9, 2024
  • Patched Versions:
  • Affected Versions: <=

Vulnerability Details:

  • Name: Collapse-O-Matic <=
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2023-7030
  • CVSS Score: 6.4
  • Publicly Published: April 23, 2024
  • Researcher: Richard Telleng (stueotue)
  • Description: The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' shortcode in all versions up to, and including, due to insufficient input sanitization and output escaping on the 'tag' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


The Collapse-O-Matic for WordPress has a vulnerability in versions up to and including that allows for stored cross-site scripting via the plugin's shortcode. This vulnerability has been patched in version

Detailed Overview:

The vulnerability in Collapse-O-Matic was identified by researcher Richard Telleng. It resides in the 'expand' shortcode, specifically in the 'tag' attribute which lacks proper sanitization, allowing stored XSS attacks. This issue could enable attackers to execute scripts on the browser of anyone who accesses a compromised page. The risks include unauthorized data access and manipulation, potentially leading to wider system compromises. The remediation for this issue has been addressed in the patched version.

Advice for Users:

  • Immediate Action: Update to the patched version immediately.
  • Check for Signs of Vulnerability: Review your website pages for unexpected or unusual scripts in the 'expand' shortcodes.
  • Alternate Plugins: While a patch is available, consider exploring other plugins offering similar functionality as a precaution.
  • Stay Updated: Keep your plugins updated to the latest versions to mitigate vulnerabilities.


The swift action by the developers of Collapse-O-Matic to release a patch highlights the critical importance of maintaining up-to-date software. Users are advised to upgrade to version or later to protect their WordPress installations against this vulnerability.


Detailed Report: 

In the ever-evolving landscape of website management, the importance of maintaining an updated and secure system cannot be overstated. A recent discovery in the WordPress plugin, Collapse-O-Matic, highlights this critical need. Known for its utility in creating collapsible text blocks, this plugin is integral to over 50,000 websites. However, the identification of a serious vulnerability, tagged as CVE-2023-7030, puts numerous sites at risk of unauthorized data manipulation and exposure.

Understanding the Vulnerability in Collapse-O-Matic

The issue lies in the plugin's 'expand' shortcode. Due to inadequate sanitization and escaping of the 'tag' attribute, attackers with contributor-level access or higher can inject malicious scripts. This vulnerability affects all versions up to and including and has been addressed in the recently released patch The gravity of this risk is underscored by a CVSS score of 6.4, indicating a substantial threat.

Historical Context and Recurring Security Challenges

This is not the first time Collapse-O-Matic has faced security challenges; since December 28, 2022, two other vulnerabilities have been documented, pointing to an ongoing battle against threats that could compromise user data and site integrity.

Risks and Potential Impacts

The exploitation of this XSS vulnerability could allow attackers to perform a range of malicious activities, from stealing user data to taking control of the affected websites. The implications are especially severe for small businesses, where such breaches can lead to significant reputational and financial damage.

Immediate Steps for Remediation

To protect your website:

  • Update immediately to the latest version,, which contains the necessary security patches.
  • Inspect your site for unusual scripts or alterations in the 'expand' shortcodes that could indicate compromise.
  • Consider alternatives if continuous updates and monitoring are a challenge, exploring other plugins that fulfill similar functions but with a stronger security record.

Advice for Small Business Owners

For small business owners, the challenge of staying on top of potential security vulnerabilities can be daunting due to limited time and resources. However, the risks of not doing so—ranging from data breaches to complete site takeovers—are too significant to ignore. Leveraging tools like managed WordPress hosting services, automated update features, and engaging with security professionals for regular audits can mitigate these risks significantly.

Conclusion: The Imperative of Vigilance

The quick response by Collapse-O-Matic's developers to patch this vulnerability illustrates the dynamic nature of web security and the perpetual need for vigilance. As a small business owner, it is paramount to prioritize these updates and consider a proactive approach to security. Regularly reviewing plugin updates, understanding the specific functionalities and potential vulnerabilities of each, and maintaining a robust backup system are essential practices that help safeguard your digital assets against evolving threats.

Staying informed and prepared is not just about fixing what's broken; it's about preventing issues before they compromise your site and your business.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Collapse-O-Matic Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2023-7030| WordPress Plugin Vulnerability Report FAQs

Leave a Comment