[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1lOUVhdmivftio2q55n5OA_3CdgeOcjy8TxVSHifxYs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":35},"CVE-2026-57381","property-hive-unauthenticated-stored-cross-site-scripting-2","Property Hive \u003C= 2.2.3 - Unauthenticated Stored Cross-Site Scripting","The Property Hive plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","propertyhive",null,"\u003C=2.2.3","2.2.4","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 00:00:00","2026-07-14 19:47:58",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5fb4f619-7fc8-482d-862f-ebb02c3870f8?source=api-prod",8,[22,23,24,25,26,27],"README.txt","includes\u002Favada-widgets\u002Fproperty-brochures-link-shortcode.php","includes\u002Fclass-ph-elementor.php","includes\u002Fph-form-functions.php","languages\u002Fpropertyhive.pot","propertyhive.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57381 (Property Hive \u003C= 2.2.3)\n\n## 1. Vulnerability Summary\nThe Property Hive plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists in the handling of property enquiry submissions. Unauthenticated users can submit the property enquiry\u002Fbook viewing form with malicious JavaScript in fields such as the enquiry message. This input is stored in the database as a \"Contact\" or \"Enquiry\" record (custom post type) without sufficient sanitization. When an administrative user views the enquiry in the Property Hive CRM or contact management dashboard, the script executes in their browser context.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `propertyhive_submit_enquiry` (or `ph_submit_enquiry`)\n*   **Vulnerable Parameter:** `enquiry` (the message body) or `first_name`\u002F`last_name`.\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** A property must exist on the site for the enquiry form to be accessible and for the nonce to be generated.\n*   **Vector:** Stored XSS. The payload is saved to the database (likely as `ph_contact` or `ph_enquiry` post type) and executed when an admin views the CRM.\n\n## 3. Code Flow\n1.  **Frontend Entry:** The user visits a property details page. The template (e.g., `includes\u002Fsalient-widgets\u002Fproperty-enquiry-form.php` or `templates\u002Fenquiry-form.php`) renders the enquiry form.\n2.  **Script Loading:** `PH_Frontend_Scripts::load_scripts` (referenced in `includes\u002Fclass-ph-elementor.php`) enqueues the enquiry form JS and localizes the `propertyhive_vars` object containing the `enquiry_nonce`.\n3.  **Submission:** The user submits the form via AJAX. The request is sent to `admin-ajax.php` with the action `propertyhive_submit_enquiry`.\n4.  **AJAX Handler:** `PH_Ajax::submit_enquiry()` (in `includes\u002Fclass-ph-ajax.php`) receives the request.\n5.  **Processing:** The handler verifies the nonce using `check_ajax_referer('propertyhive_submit_enquiry', 'nonce')` (inferred).\n6.  **Sink (Storage):** The handler uses `wp_insert_post()` to create a new record of type `ph_contact` or `ph_enquiry`. The `enquiry` parameter is stored in the `post_content` or `post_meta` without rigorous sanitization (missing `sanitize_textarea_field` or using an ineffective `ph_clean`).\n7.  **Trigger (Execution):** An admin logs in and navigates to **Property Hive -> Contacts** or **Property Hive -> Enquiries**. The dashboard renders the list of submissions. The stored payload is echoed into the page without output escaping (missing `esc_html` or `wp_kses`).\n\n## 4. Nonce Acquisition Strategy\nThe Property Hive enquiry form requires a nonce for the `propertyhive_submit_enquiry` action. This nonce is exposed in the frontend for unauthenticated users.\n\n1.  **Identify Trigger:** The enquiry form appears on property detail pages.\n2.  **Create Setup:** Create a dummy property to ensure the form is active.\n3.  **Navigation:** Use the execution agent to navigate to the property page.\n4.  **Extraction:** Use `browser_eval` to extract the nonce from the localized JavaScript object `propertyhive_vars`.\n\n**Verification Command:**\n```javascript\nbrowser_eval(\"window.propertyhive_vars?.enquiry_nonce || window.propertyhive_vars?.nonce\")\n```\n*Note: In Property Hive, the variable is typically `propertyhive_vars` and the key is `enquiry_nonce`.*\n\n## 5. Exploitation Strategy\n### Step 1: Discover a Property\nFind an existing property or create one using WP-CLI.\n\n### Step 2: Extract Nonce\nNavigate to the property URL and extract the `enquiry_nonce` from `window.propertyhive_vars`.\n\n### Step 3: Submit Malicious Enquiry\nSend a POST request to `admin-ajax.php` with the XSS payload.\n\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** POST\n*   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n*   **Parameters:**\n    *   `action`: `propertyhive_submit_enquiry`\n    *   `nonce`: `[EXTRACTED_NONCE]`\n    *   `first_name`: `Attacker`\n    *   `last_name`: `User`\n    *   `email`: `attacker@example.com`\n    *   `enquiry`: `\u003Cimg src=x onerror=\"alert('CVE-2026-57381_XSS_Triggered')\">`\n    *   `post_id`: `[PROPERTY_ID]`\n\n### Step 4: Admin Trigger\nThe payload will execute when an admin visits the \"Contacts\" list:\n`http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fedit.php?post_type=ph_contact`\n\n## 6. Test Data Setup\n1.  **Create Property:**\n    ```bash\n    wp post create --post_type=property --post_title=\"Vulnerable Property\" --post_status=publish\n    ```\n2.  **Ensure Plugin Settings:** Ensure the enquiry form is enabled (default behavior).\n3.  **Identify Property URL:**\n    ```bash\n    wp post list --post_type=property --field=ID --title=\"Vulnerable Property\" | xargs -I {} wp post get {} --field=guid\n    ```\n\n## 7. Expected Results\n*   The `admin-ajax.php` response should indicate success (e.g., `{\"success\":true}`).\n*   A new post of type `ph_contact` should exist in the database containing the payload.\n*   When the browser navigates to the admin contact list, an alert box with `CVE-2026-57381_XSS_Triggered` should appear.\n\n## 8. Verification Steps\n1.  **Check Database for Payload:**\n    ```bash\n    wp post list --post_type=ph_contact --fields=post_title,post_content\n    # OR if stored in meta:\n    wp post meta list $(wp post list --post_type=ph_contact --format=ids | awk '{print $1}')\n    ```\n2.  **Verify Presence of Unsanitized Data:**\n    Check if the string `\u003Cimg src=x onerror=` exists verbatim in the `post_content` or meta values for the newly created contact.\n\n## 9. Alternative Approaches\n*   **Field Variations:** If the `enquiry` field is sanitized, try the `first_name` or `last_name` fields, as these are often used to build the `post_title` and might be rendered unescaped in the admin list.\n*   **Request Method:** If the AJAX action is not found, check the `README.txt` for \"Property enquiry\" features and look for alternative actions in `includes\u002Fclass-ph-ajax.php` (if available via `grep`).\n*   **Bypass `ph_clean`:** If `ph_clean` is used, it often maps to `sanitize_text_field`. Test if attribute-based payloads like `\">\u003Csvg onload=alert(1)>` bypass it if the value is later echoed into an HTML attribute.","gemini-3-flash-preview","2026-07-25 08:54:44","2026-07-25 08:56:11",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","2.2.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpropertyhive\u002Ftags\u002F2.2.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpropertyhive.2.2.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpropertyhive\u002Ftags\u002F2.2.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpropertyhive.2.2.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpropertyhive\u002Ftags"]