Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter

This research plan targets CVE-2026-12430, a Stored Cross-Site Scripting (XSS) vulnerability in the Blocksy Companion plugin. The vulnerability is located in the plugin's settings, specifically within the "White Label" extension's product_description parameter.

1. Vulnerability Summary

The Blocksy Companion plugin (<= 2.1.45) fails to adequately sanitize and escape the product_description parameter within its admin settings. While the plugin utilizes wp_kses_post() for some fields, this filter is insufficient to prevent XSS when unfiltered_html is disabled (e.g., for Editors on a Multisite or restricted environments), as it allows tags and attributes (like <a> or style) that can be used to execute JavaScript in specific contexts, or it may be omitted entirely during rendering in the admin dashboard.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php?action=customize_save
• Method: POST
• Vulnerable Parameter: customized (JSON payload)
• Setting ID: blocksy_ext_white_label_settings[product_description] (inferred from blocksy-companion.php line 51 and CVE description)
• Authentication: Authenticated, Editor or higher (requires edit_theme_options capability).
• Precondition: The "White Label" extension must be active and the site must have unfiltered_html disabled for the attacker's role.

3. Code Flow

1. Persistence: An Editor uses the WordPress Customizer or the Blocksy Dashboard to update the "Product Description". The request is sent to admin-ajax.php with the customize_save action.
2. Storage: The values are processed by the Customizer API and stored in the wp_options table under the option name blocksy_ext_white_label_settings.
3. Retrieval: In blocksy-companion.php, the settings are retrieved:

   // line 51
   $blocksy_wl_settings = apply_filters( 'blocksy:ext:white-label:settings', get_option( 'blocksy_ext_white_label_settings', [] ) );
   

4. Sink: The product_description is rendered in the Blocksy Dashboard (/wp-admin/admin.php?page=ct-dashboard) to identify the plugin. If the output is rendered using a raw echo or insufficient escaping, the XSS payload executes in the context of any user (including Administrators) viewing the dashboard.

4. Nonce Acquisition Strategy

This exploit requires the customize_save nonce. Since the attacker is authenticated as an Editor, they can extract this from the Customizer interface.

1. Navigate to the WordPress Customizer: /wp-admin/customize.php.
2. The nonce is stored in the global JavaScript object _wpCustomizeSettings.
3. Use the browser_eval tool to extract the nonce:
   • Variable: window._wpCustomizeSettings.nonce.save

5. Exploitation Strategy

1. Preparation: Log in as an Editor. Ensure the "White Label" extension is active (see Test Data Setup).
2. Nonce Extraction: Navigate to /wp-admin/customize.php and run browser_eval("window._wpCustomizeSettings.nonce.save").
3. Craft Payload: Create a JSON object for the customized parameter.

   {
     "blocksy_ext_white_label_settings": {
       "product_description": "Custom Description<script>alert(document.domain)</script>"
     }
   }
   

4. Execute Injection: Send the following request via the http_request tool:
   • URL: [TARGET_URL]/wp-admin/admin-ajax.php?action=customize_save
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     wp_customize=on&
     nonce=[EXTRACTED_NONCE]&