[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWlncXIM7OK-FeSjLFUbg9NanKKH_YB5VPehPQYYOC_o":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-48885","hollerbox-fast-effective-popups-lead-generation-unauthenticated-stored-cross-site-scripting","HollerBox — Fast & Effective Popups & Lead-Generation \u003C= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting","The HollerBox — Fast & Effective Popups & Lead-Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","holler-box",null,"\u003C=2.3.10.1","2.3.11","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-02 00:00:00","2026-06-08 14:49:34",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7d54a72c-8fd5-418f-8109-078d0d75138d?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Fpopups.js","assets\u002Fjs\u002Fpopups.min.js","assets\u002Fjs\u002Freports.js","assets\u002Fjs\u002Freports.min.js","holler-box.php","includes\u002Fclass-holler-api.php","includes\u002Fclass-holler-popup.php","readme.txt","researched",false,3,"This exploitation research plan targets **CVE-2026-48885**, an unauthenticated stored cross-site scripting vulnerability in the HollerBox plugin.\n\n### 1. Vulnerability Summary\nThe HollerBox plugin fails to sufficiently sanitize user-supplied data submitted through its REST API lead-generation and conversion-tracking endpoints. Specifically, while some endpoints use `sanitize_text_field`, others (like the lead submission handler) or specific parameters are inadequately filtered. Furthermore, the admin reporting dashboard uses a vulnerable JavaScript function, `Table()`, located in `assets\u002Fjs\u002Freports.js`, which renders data into the DOM using jQuery's `.html()` method without performing output escaping.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `POST \u002Fwp-json\u002Fhollerbox\u002Fsubmit\u002F(?P\u003Cpopup_id>\\d+)` (Lead submission) or `POST \u002Fwp-json\u002Fhollerbox\u002Fconversion` (Conversion tracking).\n*   **Vulnerable Parameter:** `name` or `content`.\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** A popup must be published and its ID known.\n*   **Nonce Requirement:** The endpoints are registered with `'permission_callback' => '__return_true'`, but the REST API infrastructure may still expect a `wp_rest` nonce for cookie-based requests. For unauthenticated `fetch` requests, a nonce is typically required if the plugin's frontend scripts are active.\n\n### 3. Code Flow\n1","The HollerBox plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient input sanitization on its REST API conversion and lead submission endpoints. Attackers can inject malicious scripts into parameters like 'name' or 'content', which are then executed in the context of an administrator's session when viewing the reporting dashboard.","\u002F* includes\u002Fclass-holler-api.php *\u002F\n\npublic function track_conversion( WP_REST_Request $request ) {\n\t\u002F\u002F ...\n\t$location = parse_url( sanitize_text_field( $request->get_param( 'location' ) ), PHP_URL_PATH );\n\t$content  = sanitize_text_field( $request->get_param( 'content' ) );\n\n\tHoller_Reporting::instance()->add_conversion( $popup, $location, $content );\n\t\u002F\u002F ...\n}\n\n---\n\n\u002F* assets\u002Fjs\u002Freports.js line 271 *\u002F\n\nconst renderTable = () => {\n\n      let offSet = (currentPage - 1) * itemsPerPage\n\n      \u002F\u002Flanguage=HTML\n      return `\n\t\t  \u003Ctable>\n\t\t\t  \u003Cthead>\n\t\t\t  ${headers.map(h => `\u003Cth>${h}\u003C\u002Fth>`).join('')}\n\t\t\t  \u003C\u002Fthead>\n\t\t\t  \u003Ctbody>\n\t\t\t  ${rows.slice(offSet, offSet + itemsPerPage).\n\t\t\t  map(row => `\u003Ctr>${row.map(item => `\u003Ctd>${item}\u003C\u002Ftd>`).join('')}\u003C\u002Ftr>`).\n\t\t\t  join('')}\n\t\t\t  \u003C\u002Ftbody>\n\t\t  \u003C\u002Ftable>\n\t\t  \u003Cdiv class=\"table-pagination\">\u003C\u002Fdiv>\n      `\n    }\n\n    const mount = () => {\n      $el.html(renderTable())\n      \u002F\u002F ...","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fholler-box\u002F2.3.10.1\u002Fassets\u002Fjs\u002Fpopups.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fholler-box\u002F2.3.11\u002Fassets\u002Fjs\u002Fpopups.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fholler-box\u002F2.3.10.1\u002Fassets\u002Fjs\u002Fpopups.js\t2025-05-12 20:29:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fholler-box\u002F2.3.11\u002Fassets\u002Fjs\u002Fpopups.js\t2026-05-11 21:16:16.000000000 +0000\n@@ -2440,4 +2440,11 @@\n     makeURL,\n   }\n \n+  HollerBox.api = {\n+    apiPost,\n+    \u002F\u002F apiGet,\n+    \u002F\u002F apiPatch,\n+    \u002F\u002F apiDelete\n+  }\n+\n } )()","The exploit targets the HollerBox REST API which is open to unauthenticated users. \n\n1. Locate a site running a vulnerable version of HollerBox with at least one active popup.\n2. Identify the popup ID (often found in the frontend source code).\n3. Send an unauthenticated POST request to `\u002Fwp-json\u002Fhollerbox\u002Fconversion` (or the submit endpoint).\n4. The payload should include a malicious script in the 'content' or 'name' parameter, for example: `{\"popup_id\": \"123\", \"content\": \"\u003Cimg src=x onerror=alert(document.cookie)>\", \"location\": \"\u002F\"}`.\n5. Although `sanitize_text_field` is used in PHP, it may allow certain payloads that are rendered unsafely in the JS-based dashboard.\n6. When an administrator logs in and navigates to the 'Reports' page for that popup, the `Table()` function in `assets\u002Fjs\u002Freports.js` uses jQuery's `.html()` method to render the stored conversion data, triggering the execution of the injected script in the admin's browser context.","gemini-3-flash-preview","2026-06-26 05:44:06","2026-06-26 05:45:52",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.3.10.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fholler-box\u002Ftags\u002F2.3.10.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fholler-box.2.3.10.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fholler-box\u002Ftags\u002F2.3.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fholler-box.2.3.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fholler-box\u002Ftags"]