[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8L5S2zb6aoFtbc0IuTee7wOz13s3tGKl_2XD61_HaXs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57399","proxy-vpn-blocker-unauthenticated-stored-cross-site-scripting","Proxy & VPN Blocker \u003C= 3.5.8 - Unauthenticated Stored Cross-Site Scripting","The Proxy & VPN Blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","proxy-vpn-blocker",null,"\u003C=3.5.8","3.5.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:29:15",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb034605b-284c-478a-baec-224c4533b2e0?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Flog-ajax.js","assets\u002Fjs\u002Flog-ajax.min.js","includes\u002Fclass-proxy-vpn-blocker-settings.php","includes\u002Fclass-proxy-vpn-blocker.php","includes\u002Fhelp-mode.php","includes\u002Fpost-additions.php","includes\u002Fproxy-vpn-blocker-admin-bar.php","includes\u002Fproxy-vpn-blocker-classic-editor-support.php","researched",false,3,"This research plan outlines the technical analysis and verification methodology for **CVE-2026-57399**, a Stored Cross-Site Scripting (XSS) vulnerability in the Proxy & VPN Blocker plugin (versions $\\le$ 3.5.8).\n\n### 1. Vulnerability Summary\nThe Proxy & VPN Blocker plugin logs metadata from incoming requests (IP addresses, requested URLs, country data) to assist administrators in monitoring blocked traffic. The vulnerability exists because the plugin fails to sanitize or escape this metadata before storing it in the database and subsequently fails to escape the data when rendering it in the admin dashboard via JavaScript. Specifically, the `log-ajax.js` file handles the display of these logs using jQuery's `.append()` method, which interprets strings as HTML, allowing for the execution of arbitrary scripts.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint**: Any frontend page monitored by the plugin.\n*   **Vulnerable Parameter**: The request URI (captured as `blocked_url`).\n*   **Authentication**: Unauthenticated.\n*   **Preconditions**: The plugin must be active. The attacker's request must be logged (typically triggered by visiting from a proxy\u002FVPN IP or if the plugin is configured to log specific traffic).\n\n### 3. Code Flow\nThe vulnerability involves a path from unauthenticated ingestion to authenticated administrative rendering:\n\n1.  **Ingestion (PHP)**: An unauthenticated visitor sends a request. The plugin captures request details. The `blocked_url` is typically derived from `$_SERVER['REQUEST_URI']`.\n2.  **Storage (Database)**: The captured URL is stored in the plugin's log table (e.g., `wp_pvb_logs`) without sufficient sanitization.\n3.  **Retrieval (AJAX)**: An administrator accesses the PVB Logs page. `assets\u002Fjs\u002Flog-ajax.js` calls the `loadLogs()` function.\n4.  **Backend Fetch**: `loadLogs()` sends a POST request to `admin-ajax.php` with the action `fetch_pvb_logs`.\n5.  **Rendering (JS Sink)**: In the success callback of the AJAX request (within `assets\u002Fjs\u002Flog-ajax.js`):\n    *   The script iterates through `response.data`.\n    *   It constructs `logHtml` using the unescaped `log.blocked_url`.\n    *   **Vulnerable Line**: \n        ```javascript\n        logHtml += '\u003Cspan class=\"space ipinflux_blocked_on_url\" alt=\"' + log.blocked_url + '\">URL: ' + log.blocked_url + '\u003C\u002Fspan>';\n        \u002F\u002F ...\n        $('.log_content').append(logHtml);\n        ```\n    *   Because `log.blocked_url` is concatenated directly and then passed to `.append()`, any HTML\u002FJS in the URL is executed.\n\n### 4. Nonce Acquisition Strategy\nThe initial injection (Step 1) is unauthenticated and requires no nonce. To verify the vulnerability via the admin interface, the automated agent must acquire the nonce used by `fetch_pvb_logs`.\n\n*   **JavaScript Variable**: `pvb_action_logs`\n*   **Nonce Key**: `pvb_action_logs.nonce`\n*   **Strategy**:\n    1.  Log in as an administrator.\n    2.  Navigate to the Proxy & VPN Blocker settings page: `\u002Fwp-admin\u002Fadmin.php?page=proxy_vpn_blocker_settings`.\n    3.  Extract the nonce from the localized script data using the `browser_eval` tool:\n        `browser_eval(\"window.pvb_action_logs?.nonce\")`\n\n### 5. Exploitation Strategy (PoC Methodology)\nThis methodology uses a benign HTML payload to confirm the vulnerability in an isolated test environment.\n\n1.  **Trigger Logging**:\n    Perform an unauthenticated GET request to the site homepage with a benign HTML tag in the query string.\n    *   **Request Tool**: `http_request`\n    *   **URL**: `https:\u002F\u002F[TARGET_URL]\u002F?param=\u003Cu>xss_verification\u003C\u002Fu>`\n    *   **Note**: Ensure the request is logged by the plugin. If logging only occurs on blocks, use a proxy IP or adjust settings to \"Block All\" during testing.\n\n2.  **Admin Verification**:\n    As an administrator, navigate to the PVB Logs interface.\n    *   **Action**: Use `browser_navigate` to `\u002Fwp-admin\u002Fadmin.php?page=proxy_vpn_blocker_settings` and select the \"Logs\" tab if necessary.\n    *   **Observation**: Observe the log entry for the injected URL.\n\n### 6. Test Data Setup\n*   **Plugin**: Install `proxy-vpn-blocker` version 3.5.8.\n*   **User**: Administrator account for verification.\n*   **Configuration**: Ensure the plugin is active. Under \"PVB Settings,\" ensure the \"Log\" feature is enabled.\n\n### 7. Expected Results\n*   The `fetch_pvb_logs` AJAX response will contain the `blocked_url` with the `\u003Cu>` tag.\n*   In the Admin UI, the text `xss_verification` will appear **underlined**, confirming that the browser interpreted the injected HTML tag rather than treating it as literal text.\n\n### 8. Verification Steps (Post-Exploit)\nConfirm the payload storage in the database via WP-CLI:\n```bash\nwp db query \"SELECT blocked_url FROM wp_pvb_logs ORDER BY id DESC LIMIT 1;\"\n```\nIf the output contains the literal `\u003Cu>` tag, and the admin interface renders it as an HTML element, the vulnerability is confirmed.\n\n### 9. Alternative Approaches\n*   **Attribute Breakout**: Test injection into the `alt` attribute by using a payload like `\">\u003Cimg src=x onerror=console.log('xss_confirmed')>`. This verifies if the attribute context is also vulnerable.\n*   **IP Spoofing**: If the plugin is configured to trust headers like `X-Forwarded-For`, the `log.ip_address` field","gemini-3-flash-preview","2026-07-16 14:46:49","2026-07-16 14:48:20",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","3.5.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproxy-vpn-blocker\u002Ftags\u002F3.5.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fproxy-vpn-blocker.3.5.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproxy-vpn-blocker\u002Ftags\u002F3.5.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fproxy-vpn-blocker.3.5.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fproxy-vpn-blocker\u002Ftags"]