Exploitation Research Plan: CVE-2026-1216 - WP RSS Aggregator Reflected XSS

1. Vulnerability Summary

The WP RSS Aggregator plugin (versions <= 5.0.10) contains a reflected cross-site scripting (XSS) vulnerability in its AJAX rendering logic. Specifically, the template parameter within the JSON-encoded data POST variable is reflected into the page without sufficient sanitization or escaping when the plugin fails to find a corresponding display template. This allows unauthenticated attackers to execute arbitrary JavaScript in the context of a user's browser by tricking them into submitting a specially crafted POST request.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpra.render.display (and nopriv_wpra.render.display)
• Vulnerable Parameter: data (specifically the template key inside the JSON payload)
• Authentication: None (Unauthenticated)
• Preconditions: The plugin must be active.
• Vulnerability Type: Reflected XSS (POST-based)

3. Code Flow

1. Entry Point: In core/modules/renderer.php, the plugin registers the AJAX action wp_ajax_nopriv_wpra.render.display which maps to the $ajaxRender anonymous function.
2. Input Retrieval: $ajaxRender retrieves user input using filter_input(INPUT_POST, 'data') and decodes it as JSON into the $data array.
3. Validation Bypass: The code checks that $data['id'] and $data['page'] are numeric. Other fields like template are not validated at this stage.
4. Rendering Call: It calls $renderer->renderArgs($data, 'shortcode').
5. Vulnerable Processing: In core/src/Renderer.php, renderArgs calls $this->parseArgs($args, $type).
6. Triggering the Sink:
   • parseArgs extracts $v4Slug = trim($args['template'] ?? '').
   • It then calls $this->displays->getByV4Slug($v4Slug).
   • If $v4Slug is a malicious payload (and thus doesn't exist as a valid slug), getByV4Slug returns a Result::Err object containing an error message (e.g., "Display template '<payload>' not found").
   • renderArgs receives this error and returns $this->adminMessage($result->error()->getMessage()).
7. Execution: The adminMessage method (likely a simple HTML wrapper) echoes the unsanitized error message containing the payload back to the browser with a text/html content type.

4. Nonce Acquisition Strategy

According to the source code in core/modules/renderer.php, the wpra.render.display AJAX handler does not perform any nonce verification.

$ajaxRender = function () use ( $renderer ) {
    $dataJson = filter_input( INPUT_POST, 'data' );
    $data = json_decode( $dataJson, true );
    // ... validation of id and page only ...
    echo $renderer->renderArgs( $data, 'shortcode' );
    die();
};
add_action( 'wp_ajax_nopriv_wpra.render.display', $ajaxRender );

Because check_ajax_referer or wp_verify_nonce is missing, an attacker can trigger this endpoint unauthenticated without a nonce.

5. Exploitation Strategy

Since the reflection occurs via a POST request, the "link clicking" mentioned in the description refers to a CSRF-style attack where a victim is lured to an attacker-controlled page that auto-submits a POST form to the vulnerable WordPress site.

Steps for automated PoC:

1. Target: POST /wp-admin/admin-ajax.php
2. Headers: Content-Type: application/x-www-form-urlencoded
3. Payload:
   • action: wpra.render.display
   • data: {"id":1,"page":1,"template":"<script>alert('XSS_SUCCESS')</script>"}
4. Tool: Use http_request to send the POST request.

6. Test Data Setup

No specific configuration is strictly required as the vulnerability is triggered on the error path (providing a template that does not exist).

1. Ensure the plugin wp-rss-aggregator is installed and activated.
2. (Optional) Create one Feed Source via WP-CLI to ensure the system is initialized:
   wp post create --post_type=wprss_feed --post_title="Test Feed" --post_status=publish

7. Expected Results

The server should respond with a 200 OK status and a body containing the unescaped script tag.
Example Response Body:

<div class="wpra-message wpra-error">Display with slug &quot;<script>alert('XSS_SUCCESS')</script>&quot; not found.</div>

(Note: If the message wrapper is different, the key is the presence of the raw script tag).

8. Verification Steps

1. Execute the http_request tool with the POST parameters.
2. Inspect the response_body for the string <script>alert('XSS_SUCCESS')</script>.
3. Confirm that no HTML escaping (like <) was applied to the script tag.

9. Alternative Approaches

If the error message reflection is patched or behaves differently, attempt to inject the payload into other keys in the data JSON object that might be reflected in the layout output:

• align parameter: Although renderDisplay uses esc_attr( $attributes['align'] ), verify if any other layouts (e.g., Pro templates if available) handle this differently.
• Shortcode Context: Use a contributor-level account to create a post with `[wp-rss-aggregator template