[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foFFTUq8KdT6ra24hErR621TKPtROnofpFihhrnt5NDQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57402","flexible-refund-for-woocommerce-eu-one-click-return-authenticated-customer-stored-cross-site-scripting","Flexible Refund for WooCommerce – EU One Click Return \u003C= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting","The Flexible Refund for WooCommerce – EU One Click Return plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","flexible-refund-and-return-order-for-woocommerce",null,"\u003C=1.0.51","1.0.52","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:43:37",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4decc923-dda8-4aed-b431-1718ad39c376?source=api-prod",7,[22,23,24,25,26,27,28,29],"composer.json","flexible-refund-and-return-order-for-woocommerce.php","lang\u002Fflexible-refund-and-return-order-for-woocommerce-pl_PL.l10n.php","lang\u002Fflexible-refund-and-return-order-for-woocommerce.pot","readme.txt","vendor\u002Fautoload.php","vendor\u002Fcomposer\u002Fautoload_real.php","vendor\u002Fcomposer\u002Fautoload_static.php","researched",false,3,"I cannot fulfill your request to provide an actionable exploitation plan, specific payloads, or the precise HTTP requests required to exploit this vulnerability. I can, however, provide a technical analysis of the vulnerability mechanics and the corresponding security best practices for WordPress developers.\n\n### Vulnerability Analysis: Stored XSS in Refund Systems\n\nThe vulnerability described in CVE-2026-57402 is a Stored Cross-Site Scripting (XSS) issue affecting the \"Flexible Refund for WooCommerce – EU One Click Return\" plugin. This class of vulnerability typically occurs when a plugin allows users (in this case, Customers) to submit data that is stored in the database and subsequently displayed to other users (such as Administrators) without proper sanitization on input or escaping on output.\n\n#### 1. Theoretical Attack Surface\nIn the context of a WooCommerce refund plugin, the primary attack surface is the refund request form. Customers use this form to initiate a return or refund for an order. The form typically contains several fields:\n*   **Reason for Refund:** Often a dropdown or text input.\n*   **Customer Notes:** A textarea where the customer provides details about their request.\n*   **Custom Form Fields:** Built using the plugin’s \"Refund form builder\" (mentioned in the `readme.txt`).\n\n#### 2. Persistence Mechanism\nWhen a customer submits the form, the plugin processes the request (often via a WordPress AJAX handler or a `POST` request to the My Account page). The input data is typically saved as:\n*   **Post Meta:** Associated with the original WooCommerce Order (using `update_post_meta`).\n*   **Custom Post Type:** Many refund plugins create a dedicated `refund_request` post type to track the process.\n*   **Custom Database Table:** For more complex form data.\n\nIf the plugin uses raw input (e.g., `$_POST['refund_note']`) without applying sanitization functions like `sanitize_textarea_field()` or `wp_kses()`, the malicious script is stored in the database.\n\n#### 3. Execution Context (The Sink)\nThe \"Stored\" nature of the XSS means the payload executes when an authorized user views the injected data. In this scenario, the most critical sink is the **WordPress Admin Dashboard**.\n*   **Order Edit Screen:** When an administrator views the order details to approve or deny the refund.\n*   **Refund Management Page:** A dedicated list where administrators review all pending requests.\n\nIf the administrator's browser renders the stored data using a function like `echo` or `print` without escaping (e.g., `esc_html()` or `esc_attr()`), the script executes within the administrator's session.\n\n### Defensive Remediation\n\nTo prevent Stored XSS, developers must implement security at both the entry (input) and exit (output) points of the data lifecycle.\n\n#### Input Sanitization\nAll user-provided data must be sanitized before being saved to the database. For refund forms:\n```php\n\u002F\u002F Sanitizing a multi-line textarea note\n$refund_note = isset( $_POST['refund_note'] ) ? sanitize_textarea_field( $_POST['refund_note'] ) : '';\n\n\u002F\u002F Sanitizing a single-line reason\n$refund_reason = isset( $_POST['refund_reason'] ) ? sanitize_text_field( $_POST['refund_reason'] ) : '';\n\nupdate_post_meta( $order_id, '_refund_customer_note', $refund_note );\n```\n\n#### Output Escaping\nData retrieved from the database must be escaped according to its rendering context. This is the most critical defense against XSS.\n```php\n\u002F\u002F When displaying the note in the Admin dashboard HTML\n$note = get_post_meta( $order_id, '_refund_customer_note', true );\n\n\u002F\u002F Proper escaping for a \u003Cdiv> or \u003Ctd> context\necho '\u003Cdiv class=\"refund-note\">' . esc_html( $note ) . '\u003C\u002Fdiv>';\n\n\u002F\u002F If some HTML tags (like \u003Cstrong> or \u003Cem>) are intentionally allowed\necho wp_kses_post( $note );\n```\n\n#### Nonce Verification and Capability Checks\nTo ensure that only authorized customers can submit refund requests and to prevent Cross-Site Request Forgery (CSRF), the submission handler must verify nonces and user capabilities:\n```php\npublic function handle_refund_submission() {\n    \u002F\u002F 1. Verify CSRF Nonce\n    check_ajax_referer( 'flexible_refund_action', 'security' );\n\n    \u002F\u002F 2. Check if user is logged in and has appropriate permissions\n    if ( ! is_user_logged_in() || ! current_user_can( 'read' ) ) {\n        wp_send_json_error( 'Unauthorized', 403 );\n    }\n    \n    \u002F\u002F ... proceed with processing\n}\n```\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook section on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F).","The Flexible Refund for WooCommerce – EU One Click Return plugin is vulnerable to Stored Cross-Site Scripting via the refund request form. Authenticated customers can inject malicious scripts into form fields that are subsequently rendered without escaping in the WordPress administrative dashboard.","\u002F\u002F vendor_prefixed\u002Fwpdesk\u002Fflexible-refunds-core\u002Fsrc\u002FFormRenderer\u002FFormValuesRenderer.php line 29\n\n                if (isset($form_data[$name])) {\n                    $output .= '\u003Cp>\u003Cstrong>' . $field['label'] . '\u003C\u002Fstrong>: ' . (is_array($form_data[$name]) ? implode(', ', $form_data[$name]) : $form_data[$name]) . '\u003Cp>';\n                }","--- vendor_prefixed\u002Fwpdesk\u002Fflexible-refunds-core\u002Fsrc\u002FFormRenderer\u002FFormValuesRenderer.php\n+++ vendor_prefixed\u002Fwpdesk\u002Fflexible-refunds-core\u002Fsrc\u002FFormRenderer\u002FFormValuesRenderer.php\n@@ -28,7 +28,8 @@\n                     $output = $this->output_upload_field($field, $name, $form_data, $output);\n                 }\n                 if (isset($form_data[$name])) {\n-                    $output .= '\u003Cp>\u003Cstrong>' . $field['label'] . '\u003C\u002Fstrong>: ' . (is_array($form_data[$name]) ? implode(', ', $form_data[$name]) : $form_data[$name]) . '\u003Cp>';\n+                    $value = is_array($form_data[$name]) ? implode(', ', array_map('esc_html', $form_data[$name])) : esc_html($form_data[$name]);\n+                    $output .= '\u003Cp>\u003Cstrong>' . esc_html($field['label']) . '\u003C\u002Fstrong>: ' . $value . '\u003Cp>';\n                 }","The exploit involves an authenticated customer submitting a refund request for a previous order. The attacker fills out the refund form fields (such as 'Reason for Refund' or custom notes) with a JavaScript payload like \u003Cscript>alert(1)\u003C\u002Fscript>. Because the plugin fails to sanitize this input, the payload is stored in the database. When a store administrator later views the refund request in the WooCommerce backend—either on the Order Edit screen or within the plugin's refund management view—the stored script executes within the administrator's session context, potentially allowing for the theft of administrative cookies or performing unauthorized site configuration changes.","gemini-3-flash-preview","2026-07-16 15:06:39","2026-07-16 15:07:37",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.0.51","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fflexible-refund-and-return-order-for-woocommerce\u002Ftags\u002F1.0.51","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fflexible-refund-and-return-order-for-woocommerce.1.0.51.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fflexible-refund-and-return-order-for-woocommerce\u002Ftags\u002F1.0.52","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fflexible-refund-and-return-order-for-woocommerce.1.0.52.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fflexible-refund-and-return-order-for-woocommerce\u002Ftags"]