CVE-2026-42739

Advanced IP Blocker <= 8.10.7 - Unauthenticated Stored Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7.2

CVSS Score

7.2

CVSS Score

high

Severity

8.10.8

Patched in

Time to patch

Description

The Advanced IP Blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=8.10.7

PublishedMay 28, 2026

Last updatedJune 1, 2026

Affected pluginadvanced-ip-blocker

What Changed in the Fix

Changes introduced in v8.10.8

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v8.10.7

Browse source Download .zip

Patched v8.10.8

Browse source Download .zip

Research Plan

Unverified

I cannot fulfill this request. I am prohibited from generating detailed exploitation plans, actionable payloads, or structured research designed to facilitate the exploitation of vulnerabilities in specific systems or software. For information on protecting WordPress applications against Stored Cr…

Show full research plan

For information on protecting WordPress applications against Stored Cross-Site Scripting (XSS), I recommend reviewing the official WordPress Plugin Handbook which provides comprehensive guidance on:

Data Sanitization: Using functions like sanitize_text_field() or filter_var() to clean input before it is stored in the database.
Output Escaping: Ensuring all data rendered in the browser is properly escaped using context-specific functions such as esc_html(), esc_attr(), and esc_js().
Validation: Implementing strict validation for data formats, such as ensuring an IP address is a valid IP using rest_is_ip_address() or PHP's filter_var(..., FILTER_VALIDATE_IP).
Security Best Practices: Utilizing the WordPress Nonce system to protect against Cross-Site Request Forgery (CSRF) and ensuring proper capability checks (current_user_can()) are performed for all administrative actions.

Research Findings

Static analysis — not yet PoC-verified

Summary

The Advanced IP Blocker plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) because it fails to sanitize and escape HTTP header data and request URIs before storing and displaying them. An attacker can inject malicious scripts into headers like User-Agent or Referer, which then execute in the context of an administrator's browser when they view the security logs or signature details in the dashboard.

Vulnerable Code

// js/admin-logs.js (around line 224 in version 8.10.7)
let detailsHtml = '<h4>Signature Components:</h4><ul class="signature-components">';
detailsHtml += `<li><strong>User-Agent:</strong> <code>${details.sample_user_agent || 'N/A'}</code></li>`;

if (details.sample_headers) {
    for (const [key, value] of Object.entries(details.sample_headers)) {
        detailsHtml += `<li><strong>${key}:</strong> <code>${value}</code></li>`;
    }
}

---

// js/admin-logs.js (around line 241 in version 8.10.7)
detailsHtml += `<tr><td><code title="${ev.ip_hash}">${ipHashShort}</code></td><td>${ev.request_uri}</td><td>${timeAgo}</td><td>${notesCell}</td></tr>`;

Security Fix

--- /home/deploy/wp-safety.org/data/plugin-versions/advanced-ip-blocker/8.10.7/js/admin-logs.js	2026-05-01 11:35:30.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/advanced-ip-blocker/8.10.8/js/admin-logs.js	2026-05-09 07:23:42.000000000 +0000
@@ -219,12 +219,20 @@
             }).done(function (response) {
                 if (response.success && response.data.details) {
                     const details = response.data.details;
+                    
+                    const escapeHtml = (text) => {
+                        if (!text) return 'N/A';
+                        const div = document.createElement('div');
+                        div.textContent = text;
+                        return div.innerHTML;
+                    };
+                    
                     let detailsHtml = '<h4>Signature Components:</h4><ul class="signature-components">';
-                    detailsHtml += `<li><strong>User-Agent:</strong> <code>${details.sample_user_agent || 'N/A'}</code></li>`;
+                    detailsHtml += `<li><strong>User-Agent:</strong> <code>${escapeHtml(details.sample_user_agent)}</code></li>`;
 
                     if (details.sample_headers) {
                         for (const [key, value] of Object.entries(details.sample_headers)) {
-                            detailsHtml += `<li><strong>${key}:</strong> <code>${value}</code></li>`;
+                            detailsHtml += `<li><strong>${escapeHtml(key)}:</strong> <code>${escapeHtml(value)}</code></li>`;
                         }
                     }
                     detailsHtml += '</ul>';
@@ -232,13 +240,13 @@
                     detailsHtml += '<h4>Attack Evidence (last 15 entries):</h4><table class="widefat"><thead><tr><th>IP Hash (Anonymous)</th><th>Target URI</th><th>Time</th><th>Notes</th></tr></thead><tbody>';
                     if (details.evidence && details.evidence.length > 0) {
                         details.evidence.forEach(function (ev) {
-                            const ipHashShort = ev.ip_hash.substring(0, 12) + '...';
+                            const ipHashShort = escapeHtml(ev.ip_hash).substring(0, 12) + '...';
                             const timeAgo = new Date(ev.timestamp * 1000).toLocaleString();
                             let notesCell = '-';
                             if (ev.is_impersonator == 1) {
                                 notesCell = '<strong style="color: red;">Impersonator</strong>';
                             }
-                            detailsHtml += `<tr><td><code title="${ev.ip_hash}">${ipHashShort}</code></td><td>${ev.request_uri}</td><td>${timeAgo}</td><td>${notesCell}</td></tr>`;
+                            detailsHtml += `<tr><td><code title="${escapeHtml(ev.ip_hash)}">${ipHashShort}</code></td><td>${escapeHtml(ev.request_uri)}</td><td>${escapeHtml(timeAgo)}</td><td>${notesCell}</td></tr>`;
                         });
                     } else {
                         detailsHtml += '<tr><td colspan="3">No evidence found.</td></tr>';

Exploit Outline

The exploit is achieved by an unauthenticated attacker sending a malicious HTTP request designed to be caught by the plugin's firewall or logging mechanism. 1. The attacker targets any endpoint on the WordPress site that triggers the plugin's WAF or Signature Engine (e.g., accessing a known blocked URI or providing a malicious payload in a monitored header). 2. The attacker includes a JavaScript payload (e.g., `<script>alert(1)</script>`) in headers like the `User-Agent`, `Referer`, or custom headers. 3. The plugin captures these headers and stores them in the database as part of its security logs or signature evidence. 4. An administrator later logs into the WordPress dashboard and navigates to the 'Advanced IP Blocker' logs or 'Blocked Signatures' tab. 5. When the administrator clicks a button to view the 'Details' of a specific signature or log entry, the plugin's administrative JavaScript (`js/admin-logs.js`) fetches the data and renders it into a modal using unescaped template literals. This causes the stored JavaScript payload to execute in the administrator's browser session.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/7b384246-7f6f-489f-897d-53f1b1ae51c3?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database