Exploitation Research Plan: CVE-2026-3369

1. Vulnerability Summary

The Better Find and Replace – AI-Powered Suggestions plugin (up to 1.7.9) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the plugin's media replacement interface, specifically within the assets/js/rtafar.media.replacer.min.js file. The plugin fetches attachment data (including titles) and dynamically constructs HTML strings to display search results and previews. Because it fails to sanitize or escape the title attribute of images before injecting them into the DOM using jQuery's .html() method, an authenticated user with Author-level permissions can upload an image with a malicious title to execute arbitrary JavaScript in the context of any user (typically an administrator) who uses the plugin's media management tools.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php (for searching) and wp-admin/admin.php?page=rtafar-media-replacer (the UI where XSS triggers).
• Vulnerable Parameter: The post_title (Title) of an uploaded attachment.
• Authentication Level: Author or higher. Authors have the upload_files and edit_posts capabilities required to upload media and modify its metadata.
• Preconditions: The attacker must be able to upload an image and modify its title. The victim (Admin) must navigate to the plugin's "Media Replacer" page and either perform a search or initiate a replacement that renders the malicious image's title.

3. Code Flow

1. Data Source: The attacker uploads an image. WordPress stores the title in the wp_posts table (column post_title).
2. Data Retrieval: In the admin interface, assets/js/rtafar.media.replacer.min.js uses the query-attachments AJAX action to find images.
3. Construction (Sink 1 - Search Results):
   • Inside setupSearchInput, the plugin receives a JSON array of attachments.
   • It iterates through the results and builds an HTML string:

     // Truncated from assets/js/rtafar.media.replacer.min.js
     return '<div class="image-item">\n <img ... alt="'.concat(e.title, '" ...>')
     

   • It then calls jQuery(".image-container").html(t), where t is the unsanitized string.
4. Construction (Sink 2 - Preview Modal):
   • In setupReplaceButton, the plugin calls wp.media.attachment(id).fetch().
   • It uses the imagePreview function:

     imagePreview: function(e, t, a) {
         return '<img ... alt="'.concat(a, '"  />') // 'a' is the title
     }
     

   • It then calls jQuery(".old-media-preview-wrapper").html(...) with the result.

4. Nonce Acquisition Strategy

The query-attachments action is a WordPress core AJAX handler. While it usually requires a nonce, the plugin's custom media page enqueues the standard WordPress media library, which provides these nonces.

1. Identify the Page: The media replacer tool is located at wp-admin/admin.php?page=rtafar-media-replacer (inferred from JS naming).
2. Accessing the Page: The PoC agent should navigate to this page using browser_navigate.
3. Extracting the Nonce: If the query-attachments call requires a nonce, it is typically stored in the wp.media configuration.
   • JavaScript Check: browser_eval("wp.media.view.settings.post.nonce").
   • Alternative: Check for a localized object like rtafar_media_replacer_vars.

5. Exploitation Strategy

1. Upload Malicious Media:
   • Authenticate as an Author.
   • Upload a legitimate image file (e.g., image.jpg) using wp-admin/async-upload.php.
   • Capture the attachment_id from the response.
2. Inject XSS Payload into Title:
   • Use a POST request to wp-admin/post.php to update the attachment's metadata.
   • Payload: poc" onerror="alert(document.domain)" x="
   • This payload breaks out of the alt="..." attribute.
3. Trigger XSS (Victim Perspective):
   • Authenticate as an Administrator.
   • Navigate to wp-admin/admin.php?page=rtafar-media-replacer.
   • Locate the search input (class .input-media-replace-query).
   • Type a search string (e.g., "poc") that matches the malicious image's title.
   • The plugin will fetch the attachment and call .html(), triggering the onerror event.

6. Test Data Setup

• User: Create a user with the author role.
• Image: A standard JPG file named test.jpg.
• Plugin Page: Ensure the plugin "Better Find and Replace" is active.

7. Expected Results

• When the Administrator searches for the image in the "Media Replacer" tool, the alt attribute of the rendered <img> tag will be: alt="poc" onerror="alert(document.domain)" x="".
• The browser will attempt to load the image, and upon the (inevitable) completion or error, the onerror handler will fire, executing alert(document.domain).

8. Verification Steps

1. Database Check:
   • wp db query "SELECT post_title FROM wp_posts WHERE post_type='attachment' AND post_title LIKE '%onerror%'".
2. AJAX Response Check:
   • Intercept the query-attachments response in the browser or via http_request and verify the title field contains the raw payload: "title":"poc\" onerror=\"alert(document.domain)\" x=\"".
3. DOM Inspection:
   • Use browser_eval("document.querySelector('.image-container img')?.getAttribute('onerror')") to confirm the attribute was successfully injected into the DOM.

9. Alternative Approaches

If the search results gallery doesn't trigger immediately:

• Preview Trigger: Click the "Replace" button (class .btn-img-replace) on any image in the search results. This triggers the imagePreview logic and setupReplaceButton logic, which also uses the unsanitized title in a .html() sink.
• Video Vector: The code also handles video types. Try uploading a video and setting the title, as the setupSearchInput function handles videos in a similar (though slightly different) unsanitized concatenation path.