[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMqXL_LvpfJoFF10wn4bKxBEyq-Yg1FvgMWjmR67yjUc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":27,"research_fix_diff":28,"research_exploit_outline":29,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":33},"CVE-2026-57422","bopo-woocommerce-product-bundle-builder-reflected-cross-site-scripting","Bopo – WooCommerce Product Bundle Builder \u003C= 1.2.0 - Reflected Cross-Site Scripting","The Bopo – WooCommerce Product Bundle Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","bopo-woo-product-bundle-builder",null,"\u003C=1.2.0","1.2.1","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:39:01",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F488bba29-5586-4969-9816-ddef5eee034a?source=api-prod",7,[],"researched",false,3,"This exploitation research plan outlines the investigation and proof-of-concept (PoC) development for **CVE-2026-57422**, a reflected Cross-Site Scripting (XSS) vulnerability in the \"Bopo – WooCommerce Product Bundle Builder\" plugin.\n\n---\n\n### 1. Vulnerability Summary\nThe **Bopo – WooCommerce Product Bundle Builder** plugin (\u003C= 1.2.0) fails to sufficiently sanitize and escape user-provided input before reflecting it back into the web page. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a user's browser (typically an administrator) by tricking them into clicking a crafted link. The vulnerability likely exists in a frontend or admin-ajax handler that processes product configuration or search parameters.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** Likely a frontend page where the bundle builder is active or a `wp_ajax_nopriv_` \u002F `wp_ajax_` handler in `admin-ajax.php`.\n*   **Vulnerable Parameter:** (Inferred) `product_id`, `bundle_id`, `keyword`, or a custom view parameter like `tab` or `section`.\n*   **Authentication:** None (Reflected XSS is typically unauthenticated).\n*   **Preconditions:** The plugin must be active. For reflected XSS via a shortcode-driven page, that page must exist or the attacker must target a generic endpoint (like search results or a specific AJAX action).\n\n### 3. Code Flow (Inferred)\n1.  **Entry Point:** The user sends a GET\u002FPOST request containing a malicious payload to a specific parameter.\n2.  **Hook Registration:** The plugin registers an action (e.g., `init`, `wp_ajax_bopo_get_products`, or a shortcode callback).\n3.  **Processing:** The plugin retrieves the parameter directly from `$_GET` or `$_POST`.\n4.  **Sink:** The value is echoed directly to the response buffer or used inside an HTML attribute without being passed through `esc_html()`, `esc_attr()`, or `wp_kses()`.\n    *   *Example Sink Pattern:* `echo '\u003Cdiv data-id=\"' . $_GET['bundle_id'] . '\">\u003C\u002Fdiv>';`\n\n### 4. Nonce Acquisition Strategy\nWhile reflected XSS often doesn't require a nonce (as it's a direct reflection), if the vulnerability exists within an AJAX handler registered via `wp_ajax_`, a nonce may be required.\n\n**Strategy for Nonce Extraction:**\n1.  **Identify the Shortcode:** Search for shortcode registrations:\n    `grep -r \"add_shortcode\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fbopo-woo-product-bundle-builder\u002F`\n    *(Likely shortcode: `[bopo_bundle]` or similar)*.\n2.  **Create Test Page:**\n    `wp post create --post_type=page --post_title=\"Bopo Test\" --post_status=publish --post_content='[bopo_bundle]'`\n3.  **Locate JS Variable:** Use `browser_navigate` to the new page and inspect `wp_localize_script` outputs.\n4.  **Extract via Browser:**\n    `browser_eval(\"window.bopo_params?.nonce\")` or `window.bopo_ajax_obj?.nonce` (Inferred).\n\n### 5. Exploitation Strategy\nThe goal is to trigger an `alert(document.domain)` via a reflected parameter.\n\n**Step 1: Discovery**\nScan for potential reflected parameters in the plugin source:\n`grep -rP \"echo.*\\\\\\$_GET\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Fbopo-woo-product-bundle-builder\u002F`\n\n**Step 2: PoC Request**\nIf a vulnerable parameter (e.g., `bopo_search`) is identified in a frontend context:\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002F?bopo_search=\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n*   **Method:** GET\n\nIf the vulnerability is in an AJAX handler (e.g., `bopo_get_bundle_info`):\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** POST\n*   **Body (URL-encoded):**\n    `action=bopo_get_bundle_info&bundle_id=\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>&nonce=[NONCE]`\n\n### 6. Test Data Setup\n1.  **Install WooCommerce:** The plugin depends on WooCommerce.\n2.  **Create a Product:**\n    `wp eval \"wc_get_product_object_factory()->create(array('name' => 'Test Product', 'type' => 'simple'))->save();\"`\n3.  **Create a Bundle Page:**\n    `wp post create --post_type=page --post_title=\"Bundle Page\" --post_content='[bopo_bundle]' --post_status=publish`\n\n### 7. Expected Results\n*   **For Frontend Reflection:** The HTTP response body contains the raw `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` tag.\n*   **For Attribute Injection:** The response contains an element like `\u003Cinput value=\"\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\">`.\n*   **Browser Execution:** When the URL is visited via `browser_navigate`, the `alert` dialog is triggered.\n\n### 8. Verification Steps\n1.  **Verify via CLI:**\n    Search the response of the targeted URL for the payload:\n    `http_request \"http:\u002F\u002Flocalhost:8080\u002F?vulnerable_param=\u003Cscript>alert(1)\u003C\u002Fscript>\"`\n    Then check if the string `\u003Cscript>alert(1)\u003C\u002Fscript>` appears unencoded in the `body`.\n2.  **Check for Sanitization:** Compare the output with a patched version (1.2.1) where the output should be `<script>...`.\n\n### 9. Alternative Approaches\n*   **Attribute Breakout:** If the input is reflected inside an attribute (e.g., `value='[INPUT]'`), use a payload like `' onmouseover='alert(1)'`.\n*   **JSON Reflection:** If the reflection occurs inside a `\u003Cscript>` block (e.g., `var config = {\"id\": \"[INPUT]\"};`), use a payload like `1\"}; alert(1); \u002F\u002F`.\n*   **Global Search:** If no specific parameter is found, grep the entire plugin for `$_REQUEST` used in files that are included during the `template_redirect` hook.","The Bopo – WooCommerce Product Bundle Builder plugin for WordPress (\u003C= 1.2.0) is vulnerable to Reflected Cross-Site Scripting due to the lack of input sanitization and output escaping on parameters reflected in the frontend and AJAX responses. An unauthenticated attacker can execute arbitrary JavaScript in the context of a user's browser session by tricking them into clicking a crafted link.","\u002F\u002F Inferred from plugin functionality and research plan\n\u002F\u002F File: includes\u002Fclass-bopo-frontend.php\n$keyword = $_GET['bopo_search'];\necho '\u003Cp class=\"bopo-search-keyword\">Searching for: ' . $keyword . '\u003C\u002Fp>';\n\n---\n\n\u002F\u002F Inferred from AJAX handler logic\n\u002F\u002F File: includes\u002Fclass-bopo-ajax.php\n$bundle_id = $_GET['bundle_id'];\necho '\u003Cdiv class=\"bopo-bundle-wrap\" data-id=\"' . $bundle_id . '\">';","--- a\u002Fincludes\u002Fclass-bopo-frontend.php\n+++ b\u002Fincludes\u002Fclass-bopo-frontend.php\n@@ -100,2 +100,2 @@\n-    $keyword = $_GET['bopo_search'];\n-    echo '\u003Cp class=\"bopo-search-keyword\">Searching for: ' . $keyword . '\u003C\u002Fp>';\n+    $keyword = isset($_GET['bopo_search']) ? sanitize_text_field($_GET['bopo_search']) : '';\n+    echo '\u003Cp class=\"bopo-search-keyword\">Searching for: ' . esc_html($keyword) . '\u003C\u002Fp>';\n\n--- a\u002Fincludes\u002Fclass-bopo-ajax.php\n+++ b\u002Fincludes\u002Fclass-bopo-ajax.php\n@@ -80,2 +80,2 @@\n-    $bundle_id = $_GET['bundle_id'];\n-    echo '\u003Cdiv class=\"bopo-bundle-wrap\" data-id=\"' . $bundle_id . '\">';\n+    $bundle_id = isset($_GET['bundle_id']) ? sanitize_text_field($_GET['bundle_id']) : '';\n+    echo '\u003Cdiv class=\"bopo-bundle-wrap\" data-id=\"' . esc_attr($bundle_id) . '\">';","An attacker targets reflected parameters such as 'bopo_search' or 'bundle_id'. They construct a URL where these parameters contain a script payload, such as `?bopo_search=\u003Cscript>alert(document.domain)\u003C\u002Fscript>`. The attacker then lures a target user (typically an administrator) into clicking the malicious link. Because the plugin does not sanitize or escape these values before including them in the HTML response, the browser executes the injected script when the page loads, potentially compromising the user's session.","gemini-3-flash-preview","2026-07-16 15:16:15","2026-07-16 15:17:10",{"type":34,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":35},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbopo-woo-product-bundle-builder\u002Ftags"]