Research Plan: CVE-2026-3228 - Stored XSS via [nxs_fbembed] Shortcode

1. Vulnerability Summary

The NextScripts: Social Networks Auto-Poster (SNAP) plugin (<= 4.4.6) is vulnerable to Stored Cross-Site Scripting via the [nxs_fbembed] shortcode. The vulnerability exists because the plugin fails to sanitize or escape the snapFB post meta value when it is rendered through the shortcode callback. Authenticated users with at least Contributor permissions can create posts, set this post meta, and use the shortcode to execute arbitrary JavaScript in the context of any user (including administrators) viewing the post.

2. Attack Vector Analysis

• Vulnerable Shortcode: [nxs_fbembed]
• Vulnerable Parameter (Meta Key): snapFB
• Authentication Level: Contributor or higher (any role capable of creating/editing posts and using shortcodes).
• Injection Point: Post Metadata.
• Vector: The attacker creates a post, injects a malicious payload into the snapFB meta field, and includes the [nxs_fbembed] shortcode in the post content. When the post is viewed, the payload is echoed without escaping.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode during the init hook:
   add_shortcode('nxs_fbembed', 'nxs_fbembed_shortcode_func'); (inferred function name).
2. Meta Retrieval: Inside the shortcode callback, the plugin retrieves post meta for the current post:
   $fbID = get_post_meta($post->ID, 'snapFB', true);
3. Vulnerable Sink: The code returns or echoes an HTML string containing $fbID without using esc_html(), esc_attr(), or wp_kses():
   return '<div class="nxs_fb_embed">... ' . $fbID . ' ...</div>';
4. Execution: When a user visits the post, WordPress processes the shortcode, and the unsanitized script is rendered in the HTML response.

4. Nonce Acquisition Strategy

While shortcode rendering does not require a nonce, setting the post meta typically does.

• Approach: Contributors can set post meta via the standard WordPress post editor. If the plugin provides a specific meta box for SNAP settings, we will use that. If not, we will attempt to set the snapFB meta key directly via the post.php update flow.
• Manual Meta Injection: In standard WordPress, if "Custom Fields" are enabled, meta can be added directly. However, SNAP usually has its own interface.
• JS Variable Discovery: If the plugin uses a custom AJAX handler to save settings, we will:
  1. Navigate to the post editor (wp-admin/post-new.php).
  2. Check for localizing scripts: browser_eval("window.nxs_obj?.nonce") or similar (common pattern in this plugin).
  3. If no custom nonce is found, we rely on the standard _wpnonce for the editpost action.

5. Exploitation Strategy

Step 1: Login and Post Creation

The attacker logs in as a Contributor and starts a new post.

Step 2: Inject Malicious Meta

We need to set the snapFB meta key. Since we are a Contributor, we can use the editpost action to save meta data.

• HTTP Request: POST /wp-admin/post.php
• Content-Type: application/x-www-form-urlencoded
• Payload (Simplified):

  action=editpost
  post_ID=[POST_ID]
  _wpnonce=[NONCE]
  post_title=XSS Test
  content=[nxs_fbembed]
  meta_input[snapFB]=<script>alert(document.domain)</script>
  

  Note: If the plugin uses a specific field name in its meta box (e.g., nxs_fb_post_id), we will identify that via browser_navigate and use it instead.

Step 3: Trigger XSS

View the published (or previewed) post.

• HTTP Request: GET /?p=[POST_ID]
• Expected Response: The source code contains <script>alert(document.domain)</script> inside the HTML generated by the shortcode.

6. Test Data Setup

1. Plugin Installation: Ensure social-networks-auto-poster-facebook-twitter-g version 4.4.6 is installed.
2. User Creation:
   • Create a user with the Contributor role.

   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
   

3. Identify Meta Box Fields:
   • Navigate to the post editor as the contributor to see if SNAP adds specific input fields for Facebook post IDs.
   • Common field IDs in this plugin often follow patterns like nxs_....

7. Expected Results

• The update_post_meta call (or equivalent via post.php) should succeed in storing the script tag in the snapFB meta field.
• The [nxs_fbembed] shortcode should render the contents of snapFB directly.
• The HTTP response for the post should contain the executable script tag, confirming Stored XSS.

8. Verification Steps

1. Database Check: Verify the meta value is stored in the database.

   wp post meta get [POST_ID] snapFB
   

2. HTML Inspection: Verify the payload exists in the frontend output.

   # Through the execution agent's tool
   http_request(url="http://localhost:8080/?p=[POST_ID]")
   # Then grep the response body for the payload
   

9. Alternative Approaches

• Custom Field Bypass: If the plugin's meta box sanitizes input, but the shortcode pulls from snapFB meta regardless, try adding the meta via the "Custom Fields" meta box in WordPress (if the admin has enabled it for contributors).
• Attribute Breakout: If the payload is rendered inside an attribute (e.g., <div data-fb="[META_VALUE]">), adjust the payload to: "><script>alert(1)</script>.
• AJAX Save: Check for wp_ajax_nxs_save_settings or similar hooks in the plugin source that might allow updating post meta with weaker security checks.