Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting

This research plan targets CVE-2026-24626, a Stored Cross-Site Scripting (XSS) vulnerability in the Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider plugin (slug: logo-slider-wp) for WordPress.

---

1. Vulnerability Summary

The Logo Slider plugin (<= 4.9.0) fails to properly sanitize user-supplied input when saving slider or logo details and fails to escape this data during output. Authenticated users with Author-level permissions or higher can inject malicious JavaScript into fields such as logo titles, descriptions, or slider names. When an administrator or any site visitor views a page where the slider is rendered (via shortcode) or views the settings in the admin dashboard, the script executes in their browser context.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php (or standard post.php if using a Custom Post Type).
• Vulnerable AJAX Action: lswp_save_logo_data or lswp_create_slider (inferred based on plugin functionality).
• Vulnerable Parameter: logo_title, logo_link, or slider_name (inferred).
• Authentication Level: Author (Authenticated, PR:L).
• Preconditions: The plugin must be active. The Author must have access to the Logo Slider menu (granted by the plugin's default capability settings).

3. Code Flow (Inferred)

1. Entry Point: The user sends a POST request to admin-ajax.php with an action related to saving logos or slider settings.
2. Handler: A function like lswp_save_logo_callback() (inferred) is triggered.
3. Processing: The function retrieves input from $_POST['logo_title'].
4. Insecure Storage: The code calls update_post_meta() or a direct $wpdb query without using sanitize_text_field() on the input.
5. Vulnerable Sink (Output): When the shortcode [logo-slider] is processed, the plugin calls get_post_meta() and echoes the title directly in the HTML (e.g., inside an alt tag or title attribute) without calling esc_attr() or esc_html().

4. Nonce Acquisition Strategy

To exploit the AJAX endpoint as an Author, a valid security nonce is required.

1. Identify Script Localization: The plugin likely enqueues an admin script and localizes a nonce.
2. Creation of Page: If the nonce is only available on the plugin's settings page, the agent will navigate there.
3. Extraction:
   • Action: Login as Author.
   • Tool: browser_navigate to /wp-admin/admin.php?page=logo-slider-wp.
   • Tool: browser_eval to extract the nonce from the global JavaScript object.
   • Target Variable: window.lswp_vars?.nonce or window.logo_slider_params?.ajax_nonce (inferred).

5. Exploitation Strategy

Step 1: Authentication & Discovery

1. Login as the Author user.
2. Navigate to the Logo Slider menu to identify the exact AJAX action and parameter names used for saving logos.
3. Extract the nonce as described in Section 4.

Step 2: Inject Stored XSS Payload

Send a POST request to save a new logo entry with a malicious title.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=lswp_add_new_logo&
  nonce=[EXTRACTED_NONCE]&
  logo_title=<script>alert(document.domain)</script>&
  logo_link=https://example.com&
  slider_id=1
  

  (Note: Parameter names like lswp_add_new_logo and logo_title are inferred and must be confirmed by the agent via browser_eval or inspecting the admin page source.)

Step 3: Trigger the XSS

1. Create a public post containing the plugin's shortcode:

   wp post create --post_type=page --post_status=publish --post_title="Gallery" --post_content="[logo-slider id='1']"
   

2. Navigate to the newly created page as an unauthenticated user or an Administrator.

6. Test Data Setup

1. User Creation: Ensure an Author user exists.

   wp user create attacker author@example.com --role=author --user_pass=password123
   

2. Plugin Setup: Create at least one slider container if the plugin requires it before logos can be added.

   # Inferred CPT for sliders
   wp post create --post_type=lswp_slider --post_title="Main Slider" --post_status=publish
   

7. Expected Results

• Database: The wp_postmeta (or custom table) should contain the raw <script> tag for the logo title.
• Frontend: When viewing the page with the shortcode, the HTML source should show the unescaped script tag.
• Browser: An alert box showing the document domain should appear, confirming execution.

8. Verification Steps

1. Database Check:

   wp db query "SELECT meta_value FROM wp_postmeta WHERE meta_key = 'logo_title' AND meta_value LIKE '%<script>%'"
   

2. HTTP Response Check:
   Use http_request to fetch the frontend page and grep for the payload:

   # Verification via agent
   # Response body should contain: <script>alert(document.domain)</script>
   

9. Alternative Approaches

• Attribute Injection: If esc_html() is used but esc_attr() is not, try breaking out of an attribute:
  • Payload: "><script>alert(1)</script>
• Link Injection: If the logo_link is vulnerable, try a javascript: URI:
  • Payload: javascript:alert(1)
• CPT Edit: If the plugin uses a standard Custom Post Type (lswp_logos) and the Author has edit_posts capability, try injecting the payload directly into the Post Title via the standard WordPress editor or wp-json/wp/v2/lswp_logos.