Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Description
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=1.10.1What Changed in the Fix
Changes introduced in v1.10.2
Source Code
WordPress.org SVN# Exploitation Research Plan - CVE-2026-42759 (Affiliate Super Assistent Stored XSS) ## 1. Vulnerability Summary The **Affiliate Super Assistent (ASA1)** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** due to improper output escaping in its logging dashbo…
Show full research plan
Exploitation Research Plan - CVE-2026-42759 (Affiliate Super Assistent Stored XSS)
1. Vulnerability Summary
The Affiliate Super Assistent (ASA1) plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) due to improper output escaping in its logging dashboard. The plugin tracks errors (e.g., API failures, invalid shortcodes) and records the REQUEST_URI of the offending request into the database. When an administrator views the logs in the backend, this URI is rendered without sanitization, allowing arbitrary JavaScript execution.
2. Attack Vector Analysis
- Target Endpoint: Any frontend page containing an
[asa]shortcode, or any request that triggers a plugin error. - Vulnerable Parameter: The Request URI (path and query string).
- Authentication: Unauthenticated.
- Preconditions:
- The plugin must be active.
- A log entry must be triggered. This is easily achieved by visiting a page with a shortcode when the Amazon API is unconfigured, or by using an invalid ASIN.
- Sink:
AsaLogListTable::column_defaultinAsaLogListTable.phpreturns thelocation(URI) field directly.
3. Code Flow
- Entry Point: An unauthenticated user requests a URL like
http://wp.local/?s=[asa]invalid[/asa]&xss=<script>alert(1)</script>. - Error Trigger:
AsaCore.php(shortcode handler) attempts to process the[asa]tag. If the ASIN is invalid or API keys are missing, it triggers an error. - Logging (Source): The plugin calls
AsaLogger::logError($error)inAsaLogger.php.- Line 82:
$location = site_url($_SERVER['REQUEST_URI']);captures the malicious URI. - Line 164: The location is inserted into the
{wpdb->prefix}asa_logtable via$this->_db->prepare(). Note thatprepareprevents SQL injection but does not sanitize HTML.
- Line 82:
- Rendering (Sink): An administrator navigates to the plugin's "Log" page.
AsaLogListTable.phpis used to display the table.- Line 112:
case 'location': return $item[ $column_name ];returns the stored URI raw to the browser. - The browser executes the script embedded in the table cell.
4. Nonce Acquisition Strategy
No nonce is required for the injection phase. The vulnerability is triggered by an unauthenticated request to the frontend that generates an error log.
To verify the exploit as an administrator, the agent will need to navigate to the settings page, but the injection itself is nonce-less.
5. Exploitation Strategy
- Trigger Injection: Send a GET request to the WordPress homepage with an invalid shortcode in the query string and the XSS payload. This ensures the logger is triggered.
- Verify Storage: Use WP-CLI to confirm the payload is present in the
asa_logtable. - Trigger Execution: Simulate an administrator viewing the log page.
Injection Request
- Method:
GET - URL:
/?s=[asa]0000000000[/asa]&payload=<script>alert(document.domain)</script> - Headers: Standard browser headers.
6. Test Data Setup
- Plugin Setup: Ensure the plugin is active. It is not necessary to configure Amazon API keys; in fact, missing keys make triggering a log entry easier.
- Create Trigger Page: Create a public post containing an ASA shortcode to ensure the processing logic is active on the site.
wp post create --post_type=post --post_title="ASA Test" --post_status=publish --post_content="Check this out: [asa]1234567890[/asa]"
7. Expected Results
- The
http_requestto the frontend will complete normally. - A new row will appear in the
wp_asa_logtable where thelocationcolumn contains the<script>payload. - When a browser navigates to the admin log page, an alert box showing the document domain will appear.
8. Verification Steps
After performing the injection request, verify the database state using WP-CLI:
# Check for the injected payload in the log table
wp db query "SELECT location FROM $(wp db prefix)asa_log WHERE location LIKE '%<script>%'"
To find the exact admin page for manual verification:
# The settings page slug is amazonsimpleadmin/amazonsimpleadmin.php
# The log is typically a sub-tab or task
# Admin URL: /wp-admin/options-general.php?page=amazonsimpleadmin%2Famazonsimpleadmin.php
9. Alternative Approaches
If the location column is somehow filtered by the server before reaching the plugin (e.g., strict URI encoding), target the message or extra fields:
- Shortcode Attribute Injection: Attempt to put the payload in a shortcode attribute that might be included in the error message:
[asa title="<script>alert(1)</script>"]invalid[/asa]. - Referer Injection:
AsaLogger.phpline 84 uses$_SERVER['HTTP_REFERER']if the request is an AJAX call.- Perform a request to
admin-ajax.phpwith a maliciousRefererheader. - Payload:
Referer: http://example.com/?xss=<script>alert(1)</script> - This is highly effective as many plugins log AJAX failures.
- Perform a request to
Summary
The Affiliate Super Assistent (ASA1) plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient output escaping in its error logging dashboard. An attacker can trigger a log entry containing a malicious payload in the Request URI or Referer header, which is then executed when an administrator views the plugin's log page.
Vulnerable Code
// AsaLogger.php lines 57-61 - Capturing the unsanitized URI/Referer public function logError($error) { $location = site_url($_SERVER['REQUEST_URI']); if (strstr($location, 'admin-ajax.php') !== false) { $location = $_SERVER['HTTP_REFERER']; } --- // AsaLogListTable.php lines 110-113 - Rendering the stored location without escaping public function column_default( $item, $column_name ) { switch( $column_name ) { case 'id': case 'message': case 'location': case 'timestamp': return $item[ $column_name ]; break;
Security Fix
@@ -4,7 +4,7 @@ Plugin URI: http://www.wp-amazon-plugin.com/ Description: Lets you easily <strong>embed Amazon products</strong> into your WordPress posts by use of <strong>[asa]ASIN[/asa]</strong> shortcode. Supports the use of custom templates. You can choose from various presentation styles and of course create your own template in a few seconds. Requires at least: 5.1 -Version: 1.10.1 +Version: 1.10.2 Author: Timo Reith Author URI: http://www.ifeelweb.de/ Requires PHP: 8.1 @@ -9,7 +9,7 @@ const DB_COLL = 'asa_collection'; const DB_COLL_ITEM = 'asa_collection_item'; - const VERSION = '1.10.1'; + const VERSION = '1.10.2'; const CACHE_DEFAULT_LIFETIME = 7200; @@ -4,7 +4,7 @@ * * @author Timo Reith <timo@ifeelweb.de> * @copyright Copyright (c) 2014 ifeelweb.de - * @version $Id: AsaLogger.php 962984 2014-08-09 11:58:44Z worschtebrot $ + * @version $Id: AsaLogger.php 3524736 2026-05-06 19:13:37Z worschtebrot $ * @package */ @@ -54,9 +54,14 @@ */ public function logError($error) { - $location = site_url($_SERVER['REQUEST_URI']); + $requestUri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : ''; + $location = site_url($requestUri); if (strstr($location, 'admin-ajax.php') !== false) { - $location = $_SERVER['HTTP_REFERER']; + $referer = isset($_SERVER['HTTP_REFERER']) ? (string) $_SERVER['HTTP_REFERER'] : ''; + // Referer is attacker-controlled and was previously stored unsanitised, + // enabling stored XSS once an admin viewed the log page. esc_url_raw() + // rejects unsafe schemes (javascript:, data:, ...) and strips control chars. + $location = esc_url_raw($referer); } @@ -100,25 +100,30 @@ { switch( $column_name ) { case 'id': + return (int) $item[ $column_name ]; + case 'message': - case 'location': case 'timestamp': - return $item[ $column_name ]; - break; + return esc_html( (string) $item[ $column_name ] ); + + case 'location': + // Stored value originates from $_SERVER['HTTP_REFERER'] / REQUEST_URI + // and must never be rendered as raw HTML. Render as escaped URL only. + return esc_url( (string) $item[ $column_name ] ); case 'type': require_once 'AsaLogger.php'; $type = (int)$item[$column_name]; if ($type == AsaLogger::LOG_TYPE_ERROR) { - return __('Error', 'asa1'); + return esc_html__('Error', 'asa1'); } break; case 'extra': - return nl2br($item[$column_name]); + return nl2br( esc_html( (string) $item[ $column_name ] ) ); default: - return print_r( $item, true ) ; + return esc_html( print_r( $item, true ) ); } }
Exploit Outline
1. **Injection Phase**: An unauthenticated attacker sends a GET request to any frontend page where an `[asa]` shortcode is processed (e.g., search results or a specific post). The URL contains an invalid ASIN or triggers a plugin error, while the query string includes a JavaScript payload (e.g., `/?s=[asa]0[/asa]&xss=<script>alert(1)</script>`). 2. **Storage Phase**: The plugin's shortcode handler fails to find the product, triggering `AsaLogger::logError()`. This function captures the malicious `REQUEST_URI` and stores it in the `wp_asa_log` table. 3. **Execution Phase**: An administrator logs into the WordPress dashboard and navigates to the Affiliate Super Assistent log page (`wp-admin/options-general.php?page=amazonsimpleadmin/amazonsimpleadmin.php&task=log`). 4. **Outcome**: The `AsaLogListTable` renders the log entries, including the malicious URI in the 'Location' column without escaping, causing the browser to execute the attacker's script in the context of the administrator's session.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.