Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting

1. Vulnerability Summary

The Classified Listing plugin (versions <= 5.3.8) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists within the listing submission and update logic handled via AJAX. Specifically, the FormBuilderAjax::update_listing() function processes user-supplied data from the formData parameter using parse_str() but fails to adequately sanitize this data before storing it in the database (either as post content or post metadata). Because this action is available to unauthenticated users (when "Post as Guest" is enabled), an attacker can inject malicious scripts into a listing. These scripts execute in the context of any user (including administrators) who views the affected listing on the frontend or backend.

2. Attack Vector Analysis

• AJAX Action: rtcl_update_listing (available via wp_ajax_nopriv_rtcl_update_listing)
• Vulnerable Parameter: formData
• Authentication Required: None (unauthenticated), provided the "Post for unregistered user" setting is enabled.
• Preconditions:
  1. The plugin setting post_for_unregister must be enabled (General Settings -> Moderation).
  2. A valid Form ID (form_id) must be known (typically 1 by default).

3. Code Flow

1. Entry Point: app/Controllers/Ajax/FormBuilderAjax.php registers the AJAX actions:

   add_action( 'wp_ajax_nopriv_rtcl_update_listing', [ $this, 'update_listing' ] );
   

2. Nonce Verification: The function checks for a nonce using rtcl()->nonceId (which is rtcl_nonce) and rtcl()->nonceText (which is rtcl_ajax_nonce):

   if ( ! wp_verify_nonce( isset( $_REQUEST[ rtcl()->nonceId ] ) ? $_REQUEST[ rtcl()->nonceId ] : null, rtcl()->nonceText ) ) { ... }
   

3. Data Parsing: The formData string (containing the listing details) is parsed into an array:

   if ( ! empty( $_POST['formData'] ) ) {
       parse_str( $_POST['formData'], $formData );
   }
   

4. Registration/User Logic: If unauthenticated, it optionally registers a user based on the email field in $formData.
5. Storage (Sink): The parsed $formData is used to create or update a listing. While truncated in the source, the plugin uses wp_insert_post() and update_post_meta() to save fields like rtcl_title, rtcl_content, and custom field metadata. Because parse_str is used on raw input and subsequent validation in FBHelper::formDataValidation (inferred) focuses on structure rather than script neutralization, malicious HTML tags are stored in the database.
6. Execution: When the listing is rendered via a template (e.g., single listing page), the unsanitized metadata or content is printed to the page.

4. Nonce Acquisition Strategy

The rtcl_update_listing action requires a valid WordPress nonce. This nonce is localized for the frontend listing submission form.

1. Identify Shortcode: The listing form is rendered using the [rtcl_post_form] shortcode.
2. Setup Page: Create a public page containing this shortcode to force the plugin to enqueue its scripts and localizations.
3. Navigate: Use the browser_navigate tool to visit this page.
4. Extract Nonce: The nonce is stored in the global JavaScript object rtcl_common. Use browser_eval to retrieve it.
   • JS Variable: rtcl_common.nonce
   • Nonce ID (Parameter name): rtcl_nonce

5. Exploitation Strategy

Step 1: Enable Unauthenticated Posting
Configure the plugin to allow guests to post listings without an account.

Step 2: Create a Form Page
Create a page with the [rtcl_post_form] shortcode to expose the necessary AJAX nonce.

Step 3: Extract the Nonce
Navigate to the newly created page and extract rtcl_common.nonce.

Step 4: Execute the Exploit
Send a POST request to admin-ajax.php to create a new listing with an XSS payload.

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: rtcl_update_listing
  • rtcl_nonce: [EXTRACTED_NONCE]
  • formId: 1 (or the ID of the active listing form)
  • formData: A URL-encoded string containing:
    • rtcl_title: XSS Test <img src=x onerror=alert(document.domain)>
    • rtcl_content: Malicious Listing Content
    • email: attacker@example.com (required for guest posting)
    • _rtcl_phone: <script>alert('Stored_XSS_Phone')</script> (often unescaped in listing details)

6. Test Data Setup

1. Enable Guest Posting:

   # Update settings to enable post_for_unregister and set new listings to publish immediately
   wp option patch update rtcl_general_settings moderation post_for_unregister 1
   wp option patch update rtcl_general_settings moderation new_listing_status publish
   

2. Identify/Create Form: Ensure a form exists.

   wp post list --post_type=rtcl_cf_group
   

3. Create Form Page:

   wp post create --post_type=page --post_title="Submit Listing" --post_status=publish --post_content='[rtcl_post_form]'
   

7. Expected Results

• The AJAX response should return {"success": true, ...} and a listingId.
• A new post of type rtcl_listing will be created.
• When visiting the listing URL (e.g., /?post_type=rtcl_listing&p=[ID]), the browser will execute the injected JavaScript (alert box).

8. Verification Steps

1. Check Post Creation:

   wp post list --post_type=rtcl_listing --fields=ID,post_title,post_status
   

2. Inspect Metadata for Payload:

   # Replace [ID] with the ID from the AJAX response
   wp post meta list [ID]
   

3. Check for Sanitize Failures: Verify if the payload in post_title or _rtcl_phone remains exactly as sent (e.g., includes <script> or onerror).

9. Alternative Approaches

• Custom Fields Injection: If rtcl_title is sanitized by WordPress core, target custom fields. The plugin allows arbitrary custom fields in formData. Inject into a key like rtcl_custom_field_[ID].
• Location/Category Injection: The Import.php logic suggests that categories/locations might be created on the fly. Try injecting XSS into rtcl_tax_category or rtcl_tax_location via the formData.
• Bypass Nonce (If applicable): If the rtcl_nonce check fails or the action string is incorrect (e.g., -1), the exploit may work without a specific nonce, although the source suggests a specific check is present.