[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx2pYyx5AzGCYkuKkZh5s8-QcMYAwJSZmnXkcoILJvEs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":25,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":30},"CVE-2026-12041","chatra-live-chat-chatbot-cart-saver-authenticated-administrator-stored-cross-site-scripting-via-chatra-code-setting","Chatra Live Chat + ChatBot + Cart Saver \u003C= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting","The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","chatra-live-chat",null,"\u003C=1.0.12","medium",4.4,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 16:40:01","2026-07-08 05:34:08",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F75da660b-04c7-4f15-b49d-2aa320ef5b4b?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2026-12041 (Chatra Live Chat Stored XSS)\n\n## 1. Vulnerability Summary\nThe **Chatra Live Chat + ChatBot + Cart Saver** plugin (versions \u003C= 1.0.12) is vulnerable to **Stored Cross-Site Scripting (XSS)** via the `chatra-code` setting. The plugin allows administrators to input their Chatra widget code into a settings field. This input is saved to the WordPress options table without sufficient sanitization and is subsequently rendered on the frontend (and potentially the admin dashboard) without proper escaping.\n\nIn default single-site WordPress installations, Administrators possess the `unfiltered_html` capability, making this \"behavioral.\" However, in **Multi-site** environments or sites where `DISALLOW_UNFILTERED_HTML` is defined as `true`, this becomes a privilege escalation\u002Fsecurity bypass vulnerability, as an Administrator can execute arbitrary JavaScript in the context of other users (including Super Admins).\n\n## 2. Attack Vector Analysis\n*   **Target Endpoint:** `wp-admin\u002Foptions.php` (standard Settings API) or a custom admin handler (e.g., `wp-admin\u002Fadmin.php?page=chatra`).\n*   **Vulnerable Parameter:** `chatra_options[chatra_code]` (inferred) or `chatra-code`.\n*   **Authentication:** Authenticated, Administrator+ permissions.\n*   **Preconditions:** \n    *   Plugin version \u003C= 1.0.12.\n    *   `unfiltered_html` capability disabled (e.g., via `define('DISALLOW_UNFILTERED_HTML', true);` in `wp-config.php` or a Multi-site setup).\n\n## 3. Code Flow (Inferred)\n1.  **Registration:** The plugin registers a settings page using `add_menu_page` or `add_options_page` (likely in a class or function hooked to `admin_menu`).\n2.  **Saving:** Settings are registered via `register_setting('chatra_options_group', 'chatra_options')`. The `sanitize_callback` is either missing or insufficiently restrictive (e.g., using `sanitize_text_field` which might be bypassed or not used at all to allow the intended `\u003Cscript>` tags from Chatra).\n3.  **Persistence:** The payload is stored in the `wp_options` table under the key `chatra_options`.\n4.  **Output:** A function hooked to `wp_footer` or `wp_head` (e.g., `add_action('wp_footer', 'chatra_output_script')`) retrieves the option using `get_option('chatra_options')` and outputs the `chatra_code` value directly using `echo`, failing to use `esc_js()` or `wp_kses()`.\n\n## 4. Nonce Acquisition Strategy\nThe plugin likely uses the WordPress Settings API. To exploit this, a valid nonce for the settings group is required.\n\n1.  **Identify Settings Page:** Locate the Chatra settings menu (usually `wp-admin\u002Foptions-general.php?page=chatra` or `wp-admin\u002Fadmin.php?page=chatra`).\n2.  **Navigate and Extract:**\n    *   Use `browser_navigate` to the Chatra settings page.\n    *   Use `browser_eval` to extract the `_wpnonce` field value from the form.\n    *   **Variable Name:** `document.querySelector('input[name=\"_wpnonce\"]').value`\n    *   **Referer:** The settings page URL must be used as the Referer header in the subsequent `POST`.\n\n## 5. Exploitation Strategy\n\n### Step 1: Prepare Environment\nEnsure `unfiltered_html` is disabled to confirm the vulnerability exists for restricted administrators.\n`wp config set DISALLOW_UNFILTERED_HTML true --raw`\n\n### Step 2: Extract Nonce\n1.  Log in as Administrator.\n2.  Navigate to the Chatra settings page.\n3.  Extract the nonce for the `chatra_options-options` group (or similar).\n\n### Step 3: Inject Payload\nSend a `POST` request to `wp-admin\u002Foptions.php`.\n\n**Request Details:**\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Foptions.php`\n*   **Method:** `POST`\n*   **Headers:**\n    *   `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   `Cookie: [Admin Cookies]`\n*   **Body Parameters:**\n    *   `option_page`: `chatra_options_group` (verify via `browser_eval` of the `option_page` hidden input)\n    *   `action`: `update`\n    *   `_wpnonce`: `[EXTRACTED_NONCE]`\n    *   `chatra_options[chatra_code]`: `\u003Cscript>alert(document.domain);\u002F*\u003C\u002Fscript>` (The `\u002F*` helps neutralize any following plugin-inserted JS).\n\n### Step 4: Verification\nVisit the site homepage as any user. The `alert` should trigger.\n\n## 6. Test Data Setup\n1.  **Plugin Installation:** Install and activate `chatra-live-chat` version 1.0.12.\n2.  **User Creation:** Create an Administrator user (e.g., `admin_attacker`).\n3.  **Hardening:** Add `define('DISALLOW_UNFILTERED_HTML', true);` to `wp-config.php`.\n4.  **Target Page:** No specific shortcode is needed if the plugin hooks to `wp_footer` globally. If it requires a specific page, create a page with the Chatra shortcode (if applicable): `[chatra]`.\n\n## 7. Expected Results\n*   **Injection:** The `options.php` request returns a `302 Redirect` back to the settings page with `settings-updated=true`.\n*   **Execution:** Upon loading any frontend page, the browser executes the injected `\u003Cscript>` tag.\n*   **Storage:** The database shows the raw payload in the `chatra_options` option.\n\n## 8. Verification Steps (WP-CLI)\nConfirm the payload is stored in the database:\n```bash\nwp option get chatra_options --format=json\n```\nCheck if the output contains the unescaped payload:\n```bash\nwp option get chatra_options | grep \"\u003Cscript>alert\"\n```\n\n## 9. Alternative Approaches\n*   **Attribute Injection:** If the input is placed inside an attribute (e.g., `\u003Cdiv data-code=\"[PAYLOAD]\">`), use a breakout payload: `\">\u003Cscript>alert(1)\u003C\u002Fscript>`.\n*   **Admin-Ajax Path:** Check if the plugin uses a custom AJAX handler for saving settings (`wp_ajax_chatra_save_settings`). If so, audit `class-chatra-admin.php` for `check_ajax_referer` and `current_user_can('manage_options')`.\n*   **Bypass `sanitize_text_field`:** If `sanitize_text_field` is used, try payloads using `\u003Cimg>` with `onerror` or other tags that might survive minimal sanitization if the developer used `wp_kses` improperly.","The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.0.12. This vulnerability arises because the plugin fails to sanitize the 'chatra-code' setting during input and fails to escape it upon output, allowing authenticated administrators to inject malicious scripts that execute on the site's frontend.","--- a\u002Fchatra-live-chat\u002Fchatra.php\n+++ b\u002Fchatra-live-chat\u002Fchatra.php\n@@ -10,7 +10,7 @@\n function chatra_output_script() {\n     $options = get_option('chatra_options');\n     if (isset($options['chatra_code'])) {\n-        echo $options['chatra_code'];\n+        echo wp_kses_post($options['chatra_code']);\n     }\n }\n add_action('wp_footer', 'chatra_output_script');","An authenticated administrator targets the Chatra settings page to identify the form structure and extract the necessary security nonce. The attacker then submits a POST request to 'wp-admin\u002Foptions.php' with the 'chatra_options[chatra_code]' parameter containing a script payload, such as '\u003Cscript>alert(document.domain)\u003C\u002Fscript>'. The payload is stored in the WordPress options table and subsequently executed on any frontend page where the plugin hooks into 'wp_footer' or 'wp_head' to display the chat widget.","gemini-3-flash-preview","2026-07-25 08:36:22","2026-07-25 08:36:56",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatra-live-chat\u002Ftags"]