[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa7jRdmWRQePywHgvZKdWig65_XyXH5TJVI24KWBW4_0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":35},"CVE-2026-8892","cm-business-directory-authenticated-contributor-stored-cross-site-scripting-via-business-address-meta-fields","CM Business Directory \u003C= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields","The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the malicious payload is stored in post meta rather than post_content, WordPress's unfiltered_html capability restriction does not apply, meaning contributors who lack that capability can still inject executable HTML via the address meta fields such as cmbd_address, cmbd_cityTown, cmbd_stateCounty, cmbd_postalcode, cmbd_region, and cmbd_country.","cm-business-directory",null,"\u003C=1.5.7","1.5.8","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 16:10:17","2026-07-03 04:30:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fce3861a3-3a0f-4414-bea7-941c2d36fc39?source=api-prod",1,[22,23,24,25,26,27],"backend\u002Fcm-business-directory-backend.php","cm-business-directory.php","frontend\u002Ftemplates\u002Fcm_default\u002Fassets\u002Fcss\u002Fstyle.css","frontend\u002Ftemplates\u002Fcm_default\u002Fbusiness-page-view.php","package\u002Fcminds-plugin-config.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-8892\n\n## 1. Vulnerability Summary\nThe **CM Business Directory** plugin (\u003C= 1.5.7) is vulnerable to **Stored Cross-Site Scripting (XSS)** via several business address meta fields. While WordPress core filters `post_content` based on the `unfiltered_html` capability, it does not automatically sanitize data saved via `update_post_meta`. \n\nIn this plugin, the `CMBusinessDirectoryBackend::saveMetabox` function (hooked to `save_post`) fails to sanitize input for fields such as `cmbd_address`, `cmbd_cityTown`, and `cmbd_country`. Subsequently, the frontend templates (e.g., `business-page-view.php`) output these values using `get_post_meta` without proper escaping (e.g., `esc_html` or `esc_attr`). This allows a Contributor-level user to inject malicious scripts that execute in the context of any user (including Administrators) viewing the business page.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** `wp-admin\u002Fpost.php` (via `save_post` hook).\n*   **Vulnerable Parameters:** `cmbd_address`, `cmbd_cityTown`, `cmbd_stateCounty`, `cmbd_postalcode`, `cmbd_region`, `cmbd_country`.\n*   **Authentication Level:** Authenticated (Contributor or higher).\n*   **Preconditions:** The \"CM Business Directory\" plugin must be active. A Contributor must have permission to create\u002Fedit a `cm-business` post type.\n\n## 3. Code Flow\n1.  **Entry Point:** An authenticated user submits a POST request to `wp-admin\u002Fpost.php` to save a `cm-business` post.\n2.  **Hook Execution:** WordPress triggers the `save_post` action.\n3.  **Vulnerable Method:** `CMBusinessDirectoryBackend::saveMetabox` (in `backend\u002Fcm-business-directory-backend.php`) is called. \n4.  **Data Storage (Sink):** Inside `saveMetabox`, the code retrieves raw input from `$_POST` and calls `update_post_meta($post_id, 'cmbd_address', $_POST['cmbd_address'])` (and similar for other fields). No sanitization functions like `sanitize_text_field()` are applied.\n5.  **Rendering:** When a user views the single business page, `CMBusinessDirectoryBusinessPageView::content()` (in `frontend\u002Ftemplates\u002Fcm_default\u002Fbusiness-page-view.php`) is executed.\n6.  **XSS Trigger:** The template calls `get_post_meta` and echoes the value directly into the HTML without `esc_html()` or `esc_attr()`.\n\n## 4. Nonce Acquisition Strategy\nSince this exploit requires a Contributor to save a post, we must obtain the standard WordPress post-editing nonces and any plugin-specific metabox nonces.\n\n1.  **Identify the Post Type:** The post type is defined by `CMBusinessDirectoryShared::POST_TYPE` (verbatim from `backend\u002Fcm-business-directory-backend.php`). Based on common patterns in this plugin, this is likely `cm-business`.\n2.  **Navigate to Editor:** Use `browser_navigate` to go to `wp-admin\u002Fpost-new.php?post_type=cm-business`.\n3.  **Extract Nonces:**\n    *   The primary WordPress nonce for saving posts is usually in an input named `_wpnonce`.\n    *   Check for a custom metabox nonce. In `backend\u002Fcm-business-directory-backend.php`, the method `addMetaBox` is used. We will search the DOM for any hidden input fields containing \"nonce\".\n4.  **JavaScript Extraction:**\n    ```javascript\n    \u002F\u002F Run via browser_eval\n    {\n        post_id: document.getElementById('post_ID')?.value,\n        wpnonce: document.getElementById('_wpnonce')?.value,\n        metabox_nonce: document.querySelector('input[name*=\"cmbd_address_nonce\"]')?.value \u002F\u002F (inferred name)\n    }\n    ```\n\n## 5. Exploitation Strategy\n### Step 1: Preparation\n1.  Login as a Contributor.\n2.  Create a new `cm-business` post to get a valid `post_ID` and `_wpnonce`.\n\n### Step 2: Injection (HTTP POST)\nSubmit the payload to the address fields. We will use `cmbd_address` as the primary vector.\n\n*   **Tool:** `http_request`\n*   **URL:** `https:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fpost.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `editpost`\n    *   `post_ID`: `\u003CID_FROM_PREP>`\n    *   `_wpnonce`: `\u003CNONCE_FROM_PREP>`\n    *   `post_type`: `cm-business`\n    *   `post_title`: `XSS Business Test`\n    *   `cmbd_address`: `123 Malware Lane \u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n    *   `cmbd_cityTown`: `London`\n    *   `cmbd_country`: `UK`\n\n### Step 3: Trigger\nThe Contributor (or an Admin) views the newly created post. If the post is in \"draft\" status, use the preview link: `https:\u002F\u002F\u003Ctarget>\u002F?post_type=cm-business&p=\u003CID>&preview=true`.\n\n## 6. Test Data Setup\n1.  **User:** Create a user with the `contributor` role.\n2.  **Plugin Config:** Ensure the \"CM Business Directory\" plugin is active.\n3.  **Shortcode:** The plugin renders via a template, but ensure a page exists with `[cmbd_business]` if testing the directory index. For the single page, WordPress handles it via `single-cm-business.php` (or similar template logic in the plugin).\n\n## 7. Expected Results\n*   The `cmbd_address` value in the database will contain the raw `\u003Cscript>` tag.\n*   Upon viewing the business page, the browser will execute the script, showing an alert box with the domain name.\n*   The HTML source will look like: `\u003Cdiv class=\"cmbd-address\">123 Malware Lane \u003Cscript>alert(document.domain)\u003C\u002Fscript>\u003C\u002Fdiv>`.\n\n## 8. Verification Steps\nAfter the HTTP request, verify the storage using WP-CLI:\n```bash\n# Check the meta value directly in the database\nwp post meta get \u003CPOST_ID> cmbd_address\n```\nConfirm the output matches the payload exactly, proving no sanitization occurred during `update_post_meta`.\n\n## 9. Alternative Approaches\nIf `cmbd_address` is sanitized, test the following fields which often share the same vulnerable code path:\n*   `cmbd_cityTown`\n*   `cmbd_stateCounty`\n*   `cmbd_postalcode`\n*   `cmbd_region`\n*   `cmbd_country`\n\n**Alternative Payload (Attribute Injection):**\nIf the data is placed inside an attribute instead of a tag body:\n`\" onmouseover=\"alert(1)`","gemini-3-flash-preview","2026-07-25 09:53:01","2026-07-25 09:53:44",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","1.5.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcm-business-directory\u002Ftags\u002F1.5.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcm-business-directory.1.5.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcm-business-directory\u002Ftags\u002F1.5.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcm-business-directory.1.5.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcm-business-directory\u002Ftags"]