[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVSYsC4zfBDXOz0rvTA9zQ5ieunEffUj2fcTc8URxRC8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":20,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":37},"CVE-2026-42759","affiliate-super-assistent-unauthenticated-stored-cross-site-scripting","Affiliate Super Assistent \u003C= 1.10.1 - Unauthenticated Stored Cross-Site Scripting","The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","amazonsimpleadmin",null,"\u003C=1.10.1","1.10.2","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-30 00:00:00","2026-06-01 16:03:29",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F0242c1e3-0828-426a-a514-907204d009d0?source=api-prod",3,[22,23,24,25,26],"AsaCore.php","AsaLogListTable.php","AsaLogger.php","amazonsimpleadmin.php","readme.txt","researched",false,"# Exploitation Research Plan - CVE-2026-42759 (Affiliate Super Assistent Stored XSS)\n\n## 1. Vulnerability Summary\nThe **Affiliate Super Assistent (ASA1)** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** due to improper output escaping in its logging dashboard. The plugin tracks errors (e.g., API failures, invalid shortcodes) and records the `REQUEST_URI` of the offending request into the database. When an administrator views the logs in the backend, this URI is rendered without sanitization, allowing arbitrary JavaScript execution.\n\n## 2. Attack Vector Analysis\n*   **Target Endpoint:** Any frontend page containing an `[asa]` shortcode, or any request that triggers a plugin error.\n*   **Vulnerable Parameter:** The Request URI (path and query string).\n*   **Authentication:** Unauthenticated.\n*   **Preconditions:**\n    *   The plugin must be active.\n    *   A log entry must be triggered. This is easily achieved by visiting a page with a shortcode when the Amazon API is unconfigured, or by using an invalid ASIN.\n*   **Sink:** `AsaLogListTable::column_default` in `AsaLogListTable.php` returns the `location` (URI) field directly.\n\n## 3. Code Flow\n1.  **Entry Point:** An unauthenticated user requests a URL like `http:\u002F\u002Fwp.local\u002F?s=[asa]invalid[\u002Fasa]&xss=\u003Cscript>alert(1)\u003C\u002Fscript>`.\n2.  **Error Trigger:** `AsaCore.php` (shortcode handler) attempts to process the `[asa]` tag. If the ASIN is invalid or API keys are missing, it triggers an error.\n3.  **Logging (Source):** The plugin calls `AsaLogger::logError($error)` in `AsaLogger.php`.\n    *   Line 82: `$location = site_url($_SERVER['REQUEST_URI']);` captures the malicious URI.\n    *   Line 164: The location is inserted into the `{wpdb->prefix}asa_log` table via `$this->_db->prepare()`. Note that `prepare` prevents SQL injection but does **not** sanitize HTML.\n4.  **Rendering (Sink):** An administrator navigates to the plugin's \"Log\" page.\n    *   `AsaLogListTable.php` is used to display the table.\n    *   Line 112: `case 'location': return $item[ $column_name ];` returns the stored URI raw to the browser.\n    *   The browser executes the script embedded in the table cell.\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required** for the injection phase. The vulnerability is triggered by an unauthenticated request to the frontend that generates an error log.\n\nTo verify the exploit as an administrator, the agent will need to navigate to the settings page, but the injection itself is nonce-less.\n\n## 5. Exploitation Strategy\n1.  **Trigger Injection:** Send a GET request to the WordPress homepage with an invalid shortcode in the query string and the XSS payload. This ensures the logger is triggered.\n2.  **Verify Storage:** Use WP-CLI to confirm the payload is present in the `asa_log` table.\n3.  **Trigger Execution:** Simulate an administrator viewing the log page.\n\n### Injection Request\n*   **Method:** `GET`\n*   **URL:** `\u002F?s=[asa]0000000000[\u002Fasa]&payload=\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n*   **Headers:** Standard browser headers.\n\n## 6. Test Data Setup\n1.  **Plugin Setup:** Ensure the plugin is active. It is not necessary to configure Amazon API keys; in fact, missing keys make triggering a log entry easier.\n2.  **Create Trigger Page:** Create a public post containing an ASA shortcode to ensure the processing logic is active on the site.\n    ```bash\n    wp post create --post_type=post --post_title=\"ASA Test\" --post_status=publish --post_content=\"Check this out: [asa]1234567890[\u002Fasa]\"\n    ```\n\n## 7. Expected Results\n1.  The `http_request` to the frontend will complete normally.\n2.  A new row will appear in the `wp_asa_log` table where the `location` column contains the `\u003Cscript>` payload.\n3.  When a browser navigates to the admin log page, an alert box showing the document domain will appear.\n\n## 8. Verification Steps\nAfter performing the injection request, verify the database state using WP-CLI:\n```bash\n# Check for the injected payload in the log table\nwp db query \"SELECT location FROM $(wp db prefix)asa_log WHERE location LIKE '%\u003Cscript>%'\"\n```\n\nTo find the exact admin page for manual verification:\n```bash\n# The settings page slug is amazonsimpleadmin\u002Famazonsimpleadmin.php\n# The log is typically a sub-tab or task\n# Admin URL: \u002Fwp-admin\u002Foptions-general.php?page=amazonsimpleadmin%2Famazonsimpleadmin.php\n```\n\n## 9. Alternative Approaches\nIf the `location` column is somehow filtered by the server before reaching the plugin (e.g., strict URI encoding), target the `message` or `extra` fields:\n1.  **Shortcode Attribute Injection:** Attempt to put the payload in a shortcode attribute that might be included in the error message: `[asa title=\"\u003Cscript>alert(1)\u003C\u002Fscript>\"]invalid[\u002Fasa]`.\n2.  **Referer Injection:** `AsaLogger.php` line 84 uses `$_SERVER['HTTP_REFERER']` if the request is an AJAX call.\n    *   Perform a request to `admin-ajax.php` with a malicious `Referer` header.\n    *   Payload: `Referer: http:\u002F\u002Fexample.com\u002F?xss=\u003Cscript>alert(1)\u003C\u002Fscript>`\n    *   This is highly effective as many plugins log AJAX failures.","The Affiliate Super Assistent (ASA1) plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient output escaping in its error logging dashboard. An attacker can trigger a log entry containing a malicious payload in the Request URI or Referer header, which is then executed when an administrator views the plugin's log page.","\u002F\u002F AsaLogger.php lines 57-61 - Capturing the unsanitized URI\u002FReferer\npublic function logError($error)\n{\n    $location = site_url($_SERVER['REQUEST_URI']);\n    if (strstr($location, 'admin-ajax.php') !== false) {\n        $location = $_SERVER['HTTP_REFERER'];\n    }\n\n---\n\n\u002F\u002F AsaLogListTable.php lines 110-113 - Rendering the stored location without escaping\npublic function column_default( $item, $column_name )\n{\n    switch( $column_name ) {\n        case 'id':\n        case 'message':\n        case 'location':\n        case 'timestamp':\n            return $item[ $column_name ];\n            break;","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002Famazonsimpleadmin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002Famazonsimpleadmin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002Famazonsimpleadmin.php\t2026-05-03 13:46:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002Famazonsimpleadmin.php\t2026-05-06 19:13:38.000000000 +0000\n@@ -4,7 +4,7 @@\n Plugin URI: http:\u002F\u002Fwww.wp-amazon-plugin.com\u002F\n Description: Lets you easily \u003Cstrong>embed Amazon products\u003C\u002Fstrong> into your WordPress posts by use of \u003Cstrong>[asa]ASIN[\u002Fasa]\u003C\u002Fstrong> shortcode. Supports the use of custom templates. You can choose from various presentation styles and of course create your own template in a few seconds.\n Requires at least: 5.1\n-Version: 1.10.1\n+Version: 1.10.2\n Author: Timo Reith\n Author URI: http:\u002F\u002Fwww.ifeelweb.de\u002F\n Requires PHP: 8.1\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaCore.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaCore.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaCore.php\t2026-05-03 13:46:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaCore.php\t2026-05-06 19:13:38.000000000 +0000\n@@ -9,7 +9,7 @@\n     const DB_COLL         = 'asa_collection';\n     const DB_COLL_ITEM    = 'asa_collection_item';\n \n-    const VERSION = '1.10.1';\n+    const VERSION = '1.10.2';\n \n     const CACHE_DEFAULT_LIFETIME = 7200;\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaLogger.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaLogger.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaLogger.php\t2014-08-09 11:58:44.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaLogger.php\t2026-05-06 19:13:38.000000000 +0000\n@@ -4,7 +4,7 @@\n  *\n  * @author    Timo Reith \u003Ctimo@ifeelweb.de>\n  * @copyright Copyright (c) 2014 ifeelweb.de\n- * @version   $Id: AsaLogger.php 962984 2014-08-09 11:58:44Z worschtebrot $\n+ * @version   $Id: AsaLogger.php 3524736 2026-05-06 19:13:37Z worschtebrot $\n  * @package\n  *\u002F\n \n@@ -54,9 +54,14 @@\n      *\u002F\n     public function logError($error)\n     {\n-        $location = site_url($_SERVER['REQUEST_URI']);\n+        $requestUri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';\n+        $location   = site_url($requestUri);\n         if (strstr($location, 'admin-ajax.php') !== false) {\n-            $location = $_SERVER['HTTP_REFERER'];\n+            $referer = isset($_SERVER['HTTP_REFERER']) ? (string) $_SERVER['HTTP_REFERER'] : '';\n+            \u002F\u002F Referer is attacker-controlled and was previously stored unsanitised,\n+            \u002F\u002F enabling stored XSS once an admin viewed the log page. esc_url_raw()\n+            \u002F\u002F rejects unsafe schemes (javascript:, data:, ...) and strips control chars.\n+            $location = esc_url_raw($referer);\n         }\n \n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaLogListTable.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaLogListTable.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.1\u002FAsaLogListTable.php\t2021-08-30 22:16:12.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Famazonsimpleadmin\u002F1.10.2\u002FAsaLogListTable.php\t2026-05-06 19:13:38.000000000 +0000\n@@ -100,25 +100,30 @@\n     {\n         switch( $column_name ) {\n             case 'id':\n+                return (int) $item[ $column_name ];\n+\n             case 'message':\n-            case 'location':\n             case 'timestamp':\n-                return $item[ $column_name ];\n-                break;\n+                return esc_html( (string) $item[ $column_name ] );\n+\n+            case 'location':\n+                \u002F\u002F Stored value originates from $_SERVER['HTTP_REFERER'] \u002F REQUEST_URI\n+                \u002F\u002F and must never be rendered as raw HTML. Render as escaped URL only.\n+                return esc_url( (string) $item[ $column_name ] );\n \n             case 'type':\n                 require_once 'AsaLogger.php';\n                 $type = (int)$item[$column_name];\n                 if ($type == AsaLogger::LOG_TYPE_ERROR) {\n-                    return __('Error', 'asa1');\n+                    return esc_html__('Error', 'asa1');\n                 }\n                 break;\n \n             case 'extra':\n-                return nl2br($item[$column_name]);\n+                return nl2br( esc_html( (string) $item[ $column_name ] ) );\n \n             default:\n-                return print_r( $item, true ) ;\n+                return esc_html( print_r( $item, true ) );\n         }\n     }","1. **Injection Phase**: An unauthenticated attacker sends a GET request to any frontend page where an `[asa]` shortcode is processed (e.g., search results or a specific post). The URL contains an invalid ASIN or triggers a plugin error, while the query string includes a JavaScript payload (e.g., `\u002F?s=[asa]0[\u002Fasa]&xss=\u003Cscript>alert(1)\u003C\u002Fscript>`). \n2. **Storage Phase**: The plugin's shortcode handler fails to find the product, triggering `AsaLogger::logError()`. This function captures the malicious `REQUEST_URI` and stores it in the `wp_asa_log` table.\n3. **Execution Phase**: An administrator logs into the WordPress dashboard and navigates to the Affiliate Super Assistent log page (`wp-admin\u002Foptions-general.php?page=amazonsimpleadmin\u002Famazonsimpleadmin.php&task=log`). \n4. **Outcome**: The `AsaLogListTable` renders the log entries, including the malicious URI in the 'Location' column without escaping, causing the browser to execute the attacker's script in the context of the administrator's session.","gemini-3-flash-preview","2026-06-04 14:59:45","2026-06-04 15:01:33",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.10.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Famazonsimpleadmin\u002Ftags\u002F1.10.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Famazonsimpleadmin.1.10.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Famazonsimpleadmin\u002Ftags\u002F1.10.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Famazonsimpleadmin.1.10.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Famazonsimpleadmin\u002Ftags"]