HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting
Description
The HollerBox — Fast & Effective Popups & Lead-Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v2.3.11
Source Code
WordPress.org SVNThis exploitation research plan targets **CVE-2026-48885**, an unauthenticated stored cross-site scripting vulnerability in the HollerBox plugin. ### 1. Vulnerability Summary The HollerBox plugin fails to sufficiently sanitize user-supplied data submitted through its REST API lead-generation and co…
Show full research plan
This exploitation research plan targets CVE-2026-48885, an unauthenticated stored cross-site scripting vulnerability in the HollerBox plugin.
1. Vulnerability Summary
The HollerBox plugin fails to sufficiently sanitize user-supplied data submitted through its REST API lead-generation and conversion-tracking endpoints. Specifically, while some endpoints use sanitize_text_field, others (like the lead submission handler) or specific parameters are inadequately filtered. Furthermore, the admin reporting dashboard uses a vulnerable JavaScript function, Table(), located in assets/js/reports.js, which renders data into the DOM using jQuery's .html() method without performing output escaping.
2. Attack Vector Analysis
- Endpoint:
POST /wp-json/hollerbox/submit/(?P<popup_id>\d+)(Lead submission) orPOST /wp-json/hollerbox/conversion(Conversion tracking). - Vulnerable Parameter:
nameorcontent. - Authentication: None (Unauthenticated).
- Preconditions: A popup must be published and its ID known.
- Nonce Requirement: The endpoints are registered with
'permission_callback' => '__return_true', but the REST API infrastructure may still expect awp_restnonce for cookie-based requests. For unauthenticatedfetchrequests, a nonce is typically required if the plugin's frontend scripts are active.
3. Code Flow
1
Summary
The HollerBox plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient input sanitization on its REST API conversion and lead submission endpoints. Attackers can inject malicious scripts into parameters like 'name' or 'content', which are then executed in the context of an administrator's session when viewing the reporting dashboard.
Vulnerable Code
/* includes/class-holler-api.php */ public function track_conversion( WP_REST_Request $request ) { // ... $location = parse_url( sanitize_text_field( $request->get_param( 'location' ) ), PHP_URL_PATH ); $content = sanitize_text_field( $request->get_param( 'content' ) ); Holler_Reporting::instance()->add_conversion( $popup, $location, $content ); // ... } --- /* assets/js/reports.js line 271 */ const renderTable = () => { let offSet = (currentPage - 1) * itemsPerPage //language=HTML return ` <table> <thead> ${headers.map(h => `<th>${h}</th>`).join('')} </thead> <tbody> ${rows.slice(offSet, offSet + itemsPerPage). map(row => `<tr>${row.map(item => `<td>${item}</td>`).join('')}</tr>`). join('')} </tbody> </table> <div class="table-pagination"></div> ` } const mount = () => { $el.html(renderTable()) // ...
Security Fix
@@ -2440,4 +2440,11 @@ makeURL, } + HollerBox.api = { + apiPost, + // apiGet, + // apiPatch, + // apiDelete + } + } )()
Exploit Outline
The exploit targets the HollerBox REST API which is open to unauthenticated users. 1. Locate a site running a vulnerable version of HollerBox with at least one active popup. 2. Identify the popup ID (often found in the frontend source code). 3. Send an unauthenticated POST request to `/wp-json/hollerbox/conversion` (or the submit endpoint). 4. The payload should include a malicious script in the 'content' or 'name' parameter, for example: `{"popup_id": "123", "content": "<img src=x onerror=alert(document.cookie)>", "location": "/"}`. 5. Although `sanitize_text_field` is used in PHP, it may allow certain payloads that are rendered unsafely in the JS-based dashboard. 6. When an administrator logs in and navigates to the 'Reports' page for that popup, the `Table()` function in `assets/js/reports.js` uses jQuery's `.html()` method to render the stored conversion data, triggering the execution of the injected script in the admin's browser context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.