Exploitation Research Plan - CVE-2026-8607 (myCred Stored XSS)

1. Vulnerability Summary

The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1. The vulnerability exists within the rendering logic of various shortcodes (e.g., [mycred_my_balance], [mycred_history]) that accept a wrap attribute. This attribute is intended to allow users to specify an HTML tag to wrap the shortcode's output (e.g., span, div, p). However, the plugin fails to sanitize or escape this attribute before concatenating it into the final HTML output, allowing an authenticated attacker with Contributor-level permissions to inject malicious scripts.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (Standard WordPress Post/Page editor).
• Authentication: Authenticated (Contributor+).
• Vulnerable Attribute: wrap within any myCred shortcode.
• Payload Location: The attribute value is reflected as an HTML tag or attribute within the rendered page content.
• Preconditions: The myCred plugin must be active, and a user with at least Contributor-level access must be able to create or edit posts.

3. Code Flow

The specific rendering functions for shortcodes are often located in includes/mycred-shortcodes.php or within specific addon files like addons/sell-content/includes/mycred-sell-shortcodes.php (referenced in addons/sell-content/myCRED-addon-sell-content.php at line 19).

Trace:

1. Shortcode Registration: In addons/buy-creds/modules/buycred-module-core.php, line 104:
   add_shortcode( MYCRED_SLUG . '_buy', 'mycred_render_buy_points' );
2. Attribute Processing (Inferred): The rendering function (e.g., mycred_render_buy_points) typically calls shortcode_atts() to parse user input.
3. The Sink: The code likely follows a pattern similar to:

   $output = '<' . $atts['wrap'] . '>' . $balance . '</' . $atts['wrap'] . '>';
   return $output;
   

   If $atts['wrap'] contains img src=x onerror=alert(1), the resulting HTML is <img src=x onerror=alert(1)>....

4. Nonce Acquisition Strategy

Since this is a Stored XSS via Post Content, the "exploitation" occurs by saving a post.

1. Login: Authenticate as a Contributor.
2. Access Editor: Navigate to wp-admin/post-new.php.
3. Extract Post Nonces: Use browser_eval to extract the necessary nonces for saving the post if using the REST API or classic editor.
   • For Classic Editor: document.querySelector('#_wpnonce').value.
   • For Gutenberg: The X-WP-Nonce header is required for REST API requests.

5. Exploitation Strategy

The goal is to create a post containing the malicious shortcode.

Step-by-step Plan:

1. Login as Contributor: Perform an HTTP POST to wp-login.php to obtain session cookies.
2. Get Post Context: Request wp-admin/post-new.php. Extract the _wpnonce and post_ID (if pre-generated).
3. Submit Malicious Post:
   • URL: https://[target]/wp-admin/post.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body Parameters:
     • action: editpost
     • post_ID: [ID]
     • _wpnonce: [extracted_nonce]
     • post_title: XSS Test
     • content: [mycred_my_balance wrap='img src=x onerror=alert(document.domain)']
     • post_status: publish (Note: Contributors can only pending, but the XSS will fire for the Admin reviewing the post).
4. Trigger: As an Admin user, navigate to the "Posts" menu or view the pending post. The payload in the wrap attribute will execute in the Admin's browser context.

6. Test Data Setup

• User: Create a user with the contributor role.
• Shortcode: Use [mycred_my_balance] or [mycred_history]. (Ensure the mycred plugin is configured so these shortcodes return some output, otherwise the wrap tag might not render).
• Page Placement: A contributor creates a "Pending Review" post.

7. Expected Results

• When the post is rendered (either in preview, on the frontend, or in the admin dashboard), the HTML source should contain:
  <img src=x onerror=alert(document.domain)>
• A browser alert displaying the site's domain should appear.

8. Verification Steps

1. Check DB via WP-CLI:
   wp post list --post_type=post --post_status=pending --fields=post_content
   Confirm the shortcode [mycred_my_balance wrap='img src...'] is stored in the database.
2. Verify Rendering:
   Use the http_request tool to fetch the post URL (as Admin) and grep for the payload:
   grep "onerror=alert" response.body

9. Alternative Approaches

• Tag Injection: If wrap is prepended with < and appended with >, try breaking out of the tag: div><script>alert(1)</script><div.
• Attribute Injection: If the output is [mycred_link wrap='div'], try injecting events: div onmouseover='alert(1)'.
• Shortcode Variants: If [mycred_my_balance] is patched, test other shortcodes registered in addons/sell-content/myCRED-addon-sell-content.php (Line 75-80), such as [mycred_sell_this].