[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu-viuwdYsssscuRB-rd4o5e8yC_Ea35w7VoQtDGLtj8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57357","search-atlas-seo-premier-seo-plugin-for-one-click-wp-publishing-integrated-ai-optimization-reflected-cross-site-scriptin","Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization \u003C= 2.6.6 - Reflected Cross-Site Scripting","The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","metasync",null,"\u003C=2.6.6","2.6.7","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:45:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F54044b8c-52f2-4887-b67c-ed78023da3ff?source=api-prod",7,[22,23,24,25,26,27,28,29],"404-monitor\u002Fclass-metasync-404-monitor-list-table.php","CODEOWNERS","admin\u002Fclass-metasync-admin.php","admin\u002Fjs\u002Fmetasync-admin.js","admin\u002Fjs\u002Fmetasync-execution-settings.js","admin\u002Fjs\u002Fmetasync-host-blocking.js","admin\u002Fjs\u002Fmetasync-opengraph.js","admin\u002Fjs\u002Fmetasync-otto-debug.js","researched",false,3,"This research plan focuses on a **Reflected Cross-Site Scripting (XSS)** vulnerability in the **Search Atlas SEO** plugin (version \u003C= 2.6.6). The vulnerability stems from the improper handling of the `tab` parameter in the admin settings dashboard, where the value is reflected in the page output without sufficient escaping.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Reflected Cross-Site Scripting (XSS)\n*   **Location:** `admin\u002Fclass-metasync-admin.php` and associated navigation rendering logic.\n*   **Cause:** The plugin uses the `tab` query parameter to manage different settings sections. This parameter is reflected in the admin interface (specifically in the navigation tabs and hidden form inputs) without being passed through `esc_attr()` or `esc_html()`. While some parts of the code use `sanitize_text_field()`, this is insufficient for preventing XSS in attribute contexts (e.g., breaking out of a `value` or `href` attribute).\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin.php?page=searchatlas`\n*   **Vulnerable Parameter:** `tab`\n*   **Authentication Required:** Administrator (to trigger the payload in their browser).\n*   **Preconditions:** An attacker must trick a logged-in administrator into clicking a specially crafted link.\n*   **Vector:** The payload is injected into the `tab` parameter. When the administrator visits the link, the payload is rendered in","The Search Atlas SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of parameters such as 'tab', 'orderby_404', and 'order_404'. Unauthenticated attackers can exploit this by tricking a logged-in administrator into clicking a malicious link, allowing for the execution of arbitrary scripts in the administrator's browser context.","\u002F\u002F 404-monitor\u002Fclass-metasync-404-monitor-list-table.php (around line 304)\nprotected function get_orderby()\n{\n\treturn isset($_REQUEST['orderby_404']) ? $_REQUEST['orderby_404'] : '';\n}\n\n\u002F**\n * Get current sort order\n *\u002F\nprotected function get_order()\n{\n\treturn isset($_REQUEST['order_404']) ? $_REQUEST['order_404'] : '';\n}\n\n---\n\n\u002F\u002F admin\u002Fjs\u002Fmetasync-admin.js (around line 2188)\nlet tabParam = new URLSearchParams(window.location.search).get('tab');\nlet tabQuery = tabParam ? '&tab=' + encodeURIComponent(tabParam) : '';\n\n\u002F\u002F Handle undefined or empty white label URL\nconst pageSlug = (whiteLableUrl && whiteLableUrl !== '') ? whiteLableUrl : 'searchatlas';\nwindow.location = metaSync.admin_url + '?page=' + pageSlug + tabQuery;","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmetasync\u002F2.6.6\u002F404-monitor\u002Fclass-metasync-404-monitor-list-table.php\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmetasync\u002F2.6.7\u002F404-monitor\u002Fclass-metasync-404-monitor-list-table.php\n@@ -304,7 +304,7 @@\n \t *\u002F\n \tprotected function get_orderby()\n \t{\n-\t\treturn isset($_REQUEST['orderby_404']) ? $_REQUEST['orderby_404'] : '';\n+\t\treturn isset($_REQUEST['orderby_404']) ? sanitize_key($_REQUEST['orderby_404']) : '';\n \t}\n \n \t\u002F**\n@@ -312,7 +312,11 @@\n \t *\u002F\n \tprotected function get_order()\n \t{\n-\t\treturn isset($_REQUEST['order_404']) ? $_REQUEST['order_404'] : '';\n+\t\t$raw = isset($_REQUEST['order_404']) ? strtolower(sanitize_key($_REQUEST['order_404'])) : '';\n+\t\tif ($raw === 'desc') {\n+\t\t\treturn 'desc';\n+\t\t}\n+\t\treturn 'asc';\n \t}\n \n \t\u002F**\n@@ -366,19 +369,21 @@\n \t\t\t\t$column_display_name = sprintf(\n \t\t\t\t\t'\u003Ca href=\"%s\">\u003Cspan>%s\u003C\u002Fspan>\u003Cspan class=\"sorting-indicators\">\u003C\u002Fspan>\u003C\u002Fa>',\n \t\t\t\t\tesc_url(add_query_arg(array('orderby_404' => $orderby, 'order_404' => $order), $current_url)),\n-\t\t\t\t\t$column_display_name\n+\t\t\t\t\tesc_html($column_display_name)\n \t\t\t\t);\n+\t\t\t} elseif ('cb' !== $column_key) {\n+\t\t\t\t$column_display_name = esc_html($column_display_name);\n \t\t\t}\n \n \t\t\t$tag = ('cb' === $column_key) ? 'td' : 'th';\n \t\t\t$scope = ('th' === $tag) ? 'scope=\"col\"' : '';\n-\t\t\t$id = $with_id ? \"id='$column_key'\" : '';\n+\t\t\t$id = $with_id ? \"id='\" . esc_attr($column_key) . \"'\" : '';\n \n \t\t\tif (!empty($class)) {\n-\t\t\t\t$class = \"class='\" . implode(' ', $class) . \"'\";\n+\t\t\t\t$class = \"class='\" . esc_attr(implode(' ', $class)) . \"'\";\n \t\t\t}\n \n-\t\t\techo \"\u003C$tag $scope $id $class>$column_display_name\u003C\u002F$tag>\";\n+\t\t\techo '\u003C' . esc_attr($tag) . ' ' . $scope . ' ' . $id . ' ' . $class . '>' . $column_display_name . '\u003C\u002F' . esc_attr($tag) . '>';\n \t\t}","The exploit targets the WordPress admin dashboard endpoint provided by the Search Atlas SEO plugin. An attacker crafts a URL containing a malicious JavaScript payload within the 'tab', 'orderby_404', or 'order_404' query parameters. For example, a payload like `\u002Fwp-admin\u002Fadmin.php?page=searchatlas&tab=\">\u003Cscript>alert(1)\u003C\u002Fscript>` can break out of an HTML attribute context. When a logged-in administrator clicks this link, the payload is rendered into the page output or used in JavaScript-driven redirections (via `window.location`) without proper sanitization, resulting in reflected XSS. The attacker requires the administrator to click a crafted link to execute the exploit.","gemini-3-flash-preview","2026-07-25 12:01:55","2026-07-25 12:03:26",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.6.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmetasync\u002Ftags\u002F2.6.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmetasync.2.6.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmetasync\u002Ftags\u002F2.6.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmetasync.2.6.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmetasync\u002Ftags"]