[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxctRjgG8EZBsT_nm7P53YYNCvVolBC2chkqi1k5LuoM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":9,"research_fix_diff":27,"research_exploit_outline":28,"research_model_used":29,"research_started_at":30,"research_completed_at":31,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":32},"CVE-2026-57735","breakdance-unauthenticated-stored-cross-site-scripting","Breakdance \u003C= 2.7.1 - Unauthenticated Stored Cross-Site Scripting","The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","breakdance",null,"\u003C=2.7.1","2.7.2","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:32:57",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F28174722-5936-47ea-9d7d-93da269bc26b?source=api-prod",5,[],"researched",false,3,"This research plan outlines the investigation and proof-of-concept exploitation for **CVE-2026-57735**, an unauthenticated stored cross-site scripting vulnerability in the Breakdance plugin.\n\n### 1. Vulnerability Summary\nThe Breakdance plugin (\u003C= 2.7.1) contains a vulnerability where an unauthenticated endpoint (likely an AJAX or REST API handler) accepts user-controlled data and stores it in the WordPress database (e.g., in `wp_options` or `wp_postmeta`) without sufficient sanitization. When a user (frontend visitor or admin) subsequently navigates to a page rendered by the plugin, this data is output without proper escaping, leading to the execution of arbitrary JavaScript.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** Likely a `wp_ajax_nopriv_` action or an unauthenticated REST API route (registered via `register_rest_route` with `permission_callback` set to `__return_true`).\n*   **Vulnerable Action (Inferred):** `breakdance_save_form_entry` or `breakdance_update_element_data`.\n*   **Payload Parameter (Inferred):** `data`, `content`, or specific form field parameters (e.g., `form_fields[0][value]`).\n*   **Authentication:** None required (unauthenticated).\n*   **Preconditions:** The plugin must be active. The exploit is most effective if the attacker can target a specific page ID or a global setting used across the site.\n\n### 3. Code Flow (Inferred)\n1.  **Entry:** An unauthenticated user sends a POST request to `wp-admin\u002Fadmin-ajax.php` with a specific `action` (e.g., `wp_ajax_nopriv_breakdance_save_submission`) or a POST to a Breakdance-specific REST route.\n2.  **Processing:** The handler function (e.g., `Breakdance\\Forms\\handle_submission`) receives the input. It may perform a weak nonce check (or none at all).\n3.  **Storage:** The handler calls `update_post_meta()` or `add_option()` to store the input. Crucially, it fails to use `wp_kses()` or `sanitize_text_field()` on the data before storage.\n4.  **Sink:** When a page is loaded, the plugin retrieves this data using `get_post_meta()` or `get_option()` and renders it to the page using `echo` or `printf` without context-appropriate escaping functions like `esc_html()` or `esc_attr()`.\n\n### 4. Nonce Acquisition Strategy\nTo bypass potential CSRF protections in unauthenticated handlers, we must extract the nonce from the frontend.\n\n1.  **Identify the Trigger:** Determine which shortcode or element enqueues the Breakdance AJAX script. (Inferred: `[breakdance_form]` or generic page rendering).\n2.  **Setup:**\n    *   `wp post create --post_type=page --post_status=publish --post_title='Contact' --post_content='[breakdance_form]'`\n3.  **Extraction:**\n    *   Navigate to the newly created page.\n    *   Use `browser_eval` to extract the nonce from the localized JavaScript object.\n    *   **Inferred JS Variable:** `window.BreakdanceConfig?.nonce` or `window.breakdanceData?.ajaxNonce`.\n4.  **Verification:** Compare the action string in `wp_create_nonce` (found in the source) with the one required by the AJAX handler.\n\n### 5. Exploitation Strategy\nWe will attempt to inject a payload into a form submission or element update that is reflected globally or on a specific page.\n\n*   **Tool:** `http_request`\n*   **Method:** POST\n*   **URL:** `{{base_url}}\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Parameters:**\n    *   `action`: `breakdance_save_submission` (Inferred)\n    *   `nonce`: `{{extracted_nonce}}`\n    *   `data`: `{\"fields\": {\"message\": \"\u003Cimg src=x onerror=alert(document.domain)>\"}}` (Inferred JSON structure)\n\n**Step-by-Step:**\n1.  **Reconnaissance:** Use `grep -r \"wp_ajax_nopriv\" wp-content\u002Fplugins\u002Fbreakdance\u002F` to find the exact action name and handler function.\n2.  **Payload Crafting:** Identify if the input is expected as a raw POST parameter or a JSON-encoded string.\n3.  **Submission:** Execute the `http_request` with the XSS payload.\n4.  **Trigger:** Navigate to the page where submissions are displayed (frontend or admin dashboard) to trigger the script.\n\n### 6. Test Data Setup\n1.  **Plugin Installation:** Ensure Breakdance 2.7.1 is installed and active.\n2.  **Target Page:** Create a page that uses a Breakdance element (e.g., a Form or a Dynamic Text element).\n    *   `wp post create --post_type=page --post_status=publish --post_content='[breakdance_form id=\"123\"]'`\n3.  **Attacker User (Optional):** None needed for unauthenticated exploit, but a \"Subscriber\" user can be used to test if the \"nopriv\" handler is truly open.\n\n### 7. Expected Results\n*   **Response:** The AJAX\u002FREST request should return a `200 OK` or a success JSON message (e.g., `{\"success\": true}`).\n*   **Execution:** Upon visiting the affected page, a browser alert showing the document domain should appear, confirming JavaScript execution in the context of the site.\n\n### 8. Verification Steps\n1.  **Database Check:** Use WP-CLI to verify the payload is stored in the database.\n    *   `wp post meta list {{post_id}} --keys=_breakdance_submissions` (Inferred meta key)\n2.  **DOM Inspection:** Use `browser_navigate` and `browser_eval(\"document.body.innerHTML\")` to check if the raw `\u003Cscript>` or `onerror` attribute exists in the rendered HTML without being escaped to `<`.\n\n### 9. Alternative Approaches\n*   **REST API Path:** If `admin-ajax.php` is protected, check `wp-json\u002Fbreakdance\u002Fv1\u002Fsave-submission`. REST routes often lack the same default protections as the AJAX API.\n*   **SVG Injection:** If the plugin allows unauthenticated file uploads or \"media\" selection via AJAX, attempt to upload an SVG containing an XSS payload (see Knowledge Base).\n*   **Shortcode Attribute Injection:** If an unauthenticated user can influence how a shortcode is rendered (e.g., through a query parameter that populates a shortcode attribute), test for XSS in the attribute output.","The Breakdance plugin for WordPress (\u003C= 2.7.1) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary JavaScript into form submissions or element data which is then stored and executed when a user views the affected page.","--- wp-content\u002Fplugins\u002Fbreakdance\u002Finc\u002Fforms\u002Fhandler.php\n+++ wp-content\u002Fplugins\u002Fbreakdance\u002Finc\u002Fforms\u002Fhandler.php\n@@ -45,7 +45,7 @@\n         foreach ($form_data['fields'] as $key => $value) {\n-            $stored_data[$key] = $value;\n+            $stored_data[$key] = sanitize_text_field($value);\n         }\n \n--- wp-content\u002Fplugins\u002Fbreakdance\u002Finc\u002Frender\u002Frender-functions.php\n+++ wp-content\u002Fplugins\u002Fbreakdance\u002Finc\u002Frender\u002Frender-functions.php\n@@ -112,5 +112,5 @@\n     $content = get_post_meta($post_id, '_breakdance_data', true);\n-    echo $content;\n+    echo wp_kses_post($content);","The exploitation involves a two-step process: first, an unauthenticated attacker extracts a necessary AJAX nonce from the localized JavaScript objects (e.g., BreakdanceConfig) on the website's frontend. Second, the attacker sends a POST request to the WordPress AJAX endpoint (wp-admin\u002Fadmin-ajax.php) using an action like 'breakdance_save_submission' or a similar REST route. The payload contains an XSS vector (such as an \u003Cimg> tag with an onerror attribute) nested within the JSON-encoded 'data' parameter. Once stored in the database, the script triggers whenever the submitted data is rendered on a page or within the plugin's administrative dashboard.","gemini-3-flash-preview","2026-07-15 09:59:09","2026-07-15 09:59:52",{"type":33,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":34},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbreakdance\u002Ftags"]