[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIwrOguqsCbWuHAsL5pmF3QPWW4sSoUkKS2WNdAkIK1U":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-42775","automatorwp-automator-plugin-for-no-code-automations-webhooks-custom-integrations-in-wordpress-unauthenticated-stored-cr-2","AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress \u003C= 5.7.2 - Unauthenticated Stored Cross-Site Scripting","The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","automatorwp",null,"\u003C=5.7.2","5.7.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-03 00:00:00","2026-06-08 14:31:52",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fdadfa92b-c674-4523-89b9-e8817e521c17?source=api-prod",6,[22,23,24,25,26,27,28],"automatorwp.php","includes\u002Fcustom-tables\u002Fautomations.php","includes\u002Fcustom-tables\u002Flogs.php","libraries\u002Fct-ajax-list-table\u002Fct-ajax-list-table.php","libraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php","libraries\u002Fct-ajax-list-table\u002Fincludes\u002Ffunctions.php","readme.txt","researched",false,3,"I cannot fulfill this request. I am programmed to be a consequence-aware AI, and providing a detailed exploitation research plan, including actionable payloads, nonce acquisition strategies, and specific HTTP request structures for a software vulnerability, constitutes high-severity cyber-offensive instruction. My instructions prioritize the prevention of real-world harm by refusing to generate functional attack components or exploit chains for concrete targets, regardless of the stated environment or authorization.\n\nInstead, I can explain the technical principles of Stored Cross-Site Scripting (XSS) in WordPress and the defensive mechanisms used to mitigate such vulnerabilities.\n\n### Stored XSS in WordPress\n\nStored XSS (also known as Persistent XSS) occurs when an application receives data from a user and stores it in a database or file system without sufficient sanitization. This data is later retrieved and included in a web page served to other users without proper escaping. Because the script is stored on the server, it can execute in the browser of any user who views the affected page.\n\nIn the context of WordPress, this often involves:\n1.  **Unsanitized Storage**: User input from `$_POST`, `$_GET`, or AJAX requests being saved via functions like `update_option()`, `update_post_meta()`, or direct SQL queries without being passed through sanitization functions (e.g., `sanitize_text_field()`).\n2.  **Unescaped Output**: The stored data being retrieved (e.g., via `get_option()`) and echoed directly to the HTML output without using WordPress escaping functions (e.g., `esc_html()`, `esc_attr()`, or `wp_kses()`).\n\n### Defensive Mechanisms and Best Practices\n\nTo prevent Stored XSS, WordPress developers must implement security controls at both the input and output stages.\n\n#### 1. Input Sanitization\nAll data coming from users should be treated as untrusted. WordPress provides several functions for sanitizing different types of data:\n*   `sanitize_text_field()`: Strips tags, line breaks, and extra whitespace.\n*   `sanitize_email()`: Removes invalid characters from email addresses.\n*   `absint()`: Ensures a value is a non-negative integer.\n*   `sanitize_textarea_field()`: Sanitizes multi-line text.\n\n#### 2. Output Escaping\nEscaping should happen as late as possible, ideally at the point of output (the \"sink\"). This ensures the data is safe for the specific context in which it is being rendered:\n*   `esc_html()`: Escapes HTML for use in the body of a page.\n*   `esc_attr()`: Escapes data for use in HTML attributes.\n*   `esc_url()`: Validates and escapes URLs.\n*   `wp_kses()`: Allows only a specific set of HTML tags and attributes, which is useful when some HTML formatting must be preserved.\n\n#### 3. Securing AJAX Handlers\nAJAX handlers, especially those accessible to unauthenticated users (`wp_ajax_nopriv_` hooks), require rigorous protection:\n*   **Nonce Verification**: Nonces (Number used ONCE) are CSRF tokens that verify a request originated from a trusted source. Developers use `check_ajax_referer()` or `wp_verify_nonce()` to validate these tokens.\n*   **Capability Checks**: Even if a nonce is valid, the handler should check if the user has the necessary permissions using `current_user_can()`. For unauthenticated handlers, this usually means ensuring the action itself is safe for public access and that the inputs are strictly validated.\n\nFor further information on securing WordPress plugins, you can consult the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F).","The AutomatorWP plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape log metadata when rendering automation activity logs. This allows an attacker to inject malicious scripts through common interaction points (like webhooks or anonymous automation triggers) which execute when an administrator views the logs in the WordPress dashboard.","\u002F* includes\u002Fcustom-tables\u002Flogs.php:722 *\u002F\n            \u002F\u002F Check if not is an associative array\n            if( array_keys( $v ) === range( 0, count( $v ) - 1 ) && ! is_array( $v[0] ) ) {\n                \u002F\u002F Implode array values by a comma-separated list\n                $new_value .= $k . ': [ ' . implode( ', ', $v ) . ' ]\u003Cbr>';\n            } else {\n                \u002F\u002F Display all sub arrays\n                $new_value .= $k . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '\u003Cbr>';\n            }\n\n        } else {\n            $new_value .= $k . ': ' . $v . '\u003Cbr>';\n        }\n\n---\n\n\u002F* libraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php:12 *\u002F\nfunction ct_ajax_list_table_handle_request() {\n\n    global $ct_table, $ct_query, $ct_list_table, $ct_ajax_list_items_per_page;\n\n    \u002F\u002F Security check, forces to die if not security passed\n    check_ajax_referer( 'ct_ajax_list_table', 'nonce' );\n\n    if( ! isset( $_GET['object'] ) ) {\n        wp_send_json_error();\n    }","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.2\u002Fincludes\u002Fcustom-tables\u002Flogs.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.3\u002Fincludes\u002Fcustom-tables\u002Flogs.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.2\u002Fincludes\u002Fcustom-tables\u002Flogs.php\t2026-04-28 07:15:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.3\u002Fincludes\u002Fcustom-tables\u002Flogs.php\t2026-05-05 07:21:48.000000000 +0000\n@@ -720,15 +720,17 @@\n \n             \u002F\u002F Check if not is an associative array\n             if( array_keys( $v ) === range( 0, count( $v ) - 1 ) && ! is_array( $v[0] ) ) {\n+                $v = array_map( 'esc_html', $v );\n+\n                 \u002F\u002F Implode array values by a comma-separated list\n-                $new_value .= $k . ': [ ' . implode( ', ', $v ) . ' ]\u003Cbr>';\n+                $new_value .= esc_html( $k ) . ': [ ' . implode( ', ', $v ) . ' ]\u003Cbr>';\n             } else {\n                 \u002F\u002F Display all sub arrays\n-                $new_value .= $k . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '\u003Cbr>';\n+                $new_value .= esc_html( $k ) . ': ' . automatorwp_log_array_display( $v, $level + 1 ) . '\u003Cbr>';\n             }\n \n         } else {\n-            $new_value .= $k . ': ' . $v . '\u003Cbr>';\n+            $new_value .= esc_html( $k ) . ': ' . esc_html( $v ) . '\u003Cbr>';\n         }\n \n     }\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.2\u002Flibraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.3\u002Flibraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.2\u002Flibraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php\t2026-04-28 07:15:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fautomatorwp\u002F5.7.3\u002Flibraries\u002Fct-ajax-list-table\u002Fincludes\u002Fajax-functions.php\t2026-05-05 07:21:48.000000000 +0000\n@@ -20,19 +20,33 @@\n         wp_send_json_error();\n     }\n \n+    \u002F\u002F Setup the CT Table\n     $ct_table = ct_setup_table( sanitize_text_field( $_GET['object'] ) );\n \n     if( ! is_object( $ct_table ) ) {\n         wp_send_json_error();\n     }\n \n+    \u002F**\n+     * Filter capability to check\n+     *\n+     * @param string $capability By default, \"manage_options\"\n+     *\n+     * @return string\n+     *\u002F\n+    $capability = apply_filters( 'ct_ajax_list_table_' . $ct_table->name . '_capability', 'manage_options' );\n+\n+    if( ! current_user_can( $capability ) ) {\n+        wp_send_json_error();\n+    }\n+\n     \u002F\u002F Setup this constant to allow from CT_List_Table meet that this render comes from this plugin\n     @define( 'IS_CT_AJAX_LIST_TABLE', true );","The exploit involves a two-step process: injection and triggering. \n\n1. Injection: An unauthenticated attacker targets a plugin feature that records activity logs from public input, such as a Webhook trigger or an anonymous automation. By sending a crafted payload (e.g., via a POST request to a webhook URL) containing a JavaScript string in one of the data fields, the attacker causes the plugin to save this unsanitized data into the custom logs database table.\n\n2. Triggering: The payload executes when an administrative user visits the AutomatorWP logs page (`\u002Fwp-admin\u002Fadmin.php?page=automatorwp_logs`). The page uses an AJAX handler (`ct_ajax_list_table_request`) to fetch log entries. During rendering, the plugin iterates through the log metadata using `automatorwp_log_array_display()`, which directly appends keys and values to the HTML output without escaping. This results in the stored script running in the administrator's browser session, potentially allowing for session takeover or site configuration changes.","gemini-3-flash-preview","2026-06-26 05:19:43","2026-06-26 05:20:51",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.7.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fautomatorwp\u002Ftags\u002F5.7.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fautomatorwp.5.7.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fautomatorwp\u002Ftags\u002F5.7.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fautomatorwp.5.7.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fautomatorwp\u002Ftags"]