ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute

This research plan outlines the steps required to demonstrate a Stored Cross-Site Scripting (XSS) vulnerability in the ShopLentor plugin for WordPress. This vulnerability allows an authenticated attacker with Contributor-level permissions or higher to inject malicious scripts into pages via the blockUniqId attribute of ShopLentor's Product Grid Gutenberg blocks.

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting (XSS)
• ID: CVE-2026-6287
• Plugin: ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (slug: woolentor-addons)
• Affected Attribute: blockUniqId within Gutenberg blocks (e.g., Product Grid).
• Cause: The plugin fails to sanitize or escape the blockUniqId attribute before rendering it in the HTML output. This attribute is intended to be a unique identifier (likely for CSS/JS targeting) but can be manipulated by an attacker to include script tags.

2. Attack Vector Analysis

• Endpoint: WordPress REST API for posts (/wp-json/wp/v2/posts) or the standard Gutenberg editor flow.
• Authentication: Requires a user with at least Contributor role (to create/edit posts).
• Vulnerable Parameter: The post_content field containing a Gutenberg block comment with a malicious blockUniqId attribute.
• Payload Location: Inside the JSON attributes of the ShopLentor block (e.g., <!-- wp:woolentor/product-grid {"blockUniqId":"PAYLOAD"} /-->).

3. Code Flow

1. Entry Point: An attacker creates or updates a post containing a ShopLentor Gutenberg block (e.g., woolentor/product-grid). The attributes of this block are stored in the post_content.
2. Processing: When the post is viewed, WordPress parses the post_content. The ShopLentor plugin registers a render_callback for its blocks.
3. Sink: The PHP rendering logic (likely found in the block registration files under includes/gutenberg/ - not provided in the snippet but inferred) retrieves the blockUniqId attribute. It then echoes this value directly into the HTML, likely as an id attribute or within a script/style block, without using functions like esc_attr() or esc_js().
4. Execution: The payload is rendered in the victim's browser (e.g., an administrator viewing the post), leading to script execution.

4. Nonce Acquisition Strategy

To save a post via the REST API or the Gutenberg editor flow, a wp_rest nonce is required.

1. Navigate to Editor: Log in as a Contributor and navigate to the "New Post" page: /wp-admin/post-new.php.
2. Extract Nonce: Use browser_eval to extract the REST nonce from the WordPress global settings object.
   • JavaScript Variable: window.wpApiSettings.nonce
3. Alternative Nonce: If using the standard AJAX autosave, the _wpnonce can be found in window.heartbeatSettings.nonce.

5. Exploitation Strategy

1. Authentication: Authenticate as a Contributor user.
2. Nonce Retrieval: Navigate to /wp-admin/post-new.php and extract the wp_rest nonce using browser_eval("wpApiSettings.nonce").
3. Identify Block Name: Based on common ShopLentor naming conventions, the block is likely woolentor/product-grid.
4. Payload Construction:
   • Construct a block comment: <!-- wp:woolentor/product-grid {"blockUniqId":"\"><script>alert(document.domain)</script>"} /-->
   • This payload attempts to break out of an id attribute (e.g., <div id="..."><script>...</script>">).
5. Inject Payload: Send a POST request to /wp-json/wp/v2/posts to create a new post.
   • Method: POST
   • Headers:
     • X-WP-Nonce: [EXTRACTED_REST_NONCE]
     • Content-Type: application/json
   • Body:

     {
       "title": "ShopLentor XSS Test",
       "content": "<!-- wp:woolentor/product-grid {\"blockUniqId\":\"\\\"><script>alert(document.domain)</script>\"} /-->",
       "status": "publish"
     }
     

6. Trigger XSS: Obtain the URL of the created post and navigate to it. The script should execute immediately.

6. Test Data Setup

• Role: Ensure a user with the Contributor role exists.
• Plugin State: ShopLentor version <= 3.3.8 must be active.
• Environment: A standard WordPress installation with WooCommerce (as ShopLentor is a WooCommerce builder).

7. Expected Results

• The REST API should return a 201 Created status code.
• When viewing the post frontend, the HTML source should contain the unescaped script tag.
• A JavaScript alert box showing the document domain should appear.

8. Verification Steps

1. Check Post Content: Use WP-CLI to verify the payload is stored correctly:
   • wp post list --post_type=post (find the ID)
   • wp post get [ID] --field=post_content
2. Check HTML Output: Use the http_request tool to fetch the post URL and search for the raw payload:
   • Look for <script>alert(document.domain)</script> in the response body.
3. Confirm Lack of Escaping: Verify that the rendered HTML looks like:
   • <div id="[PREVIOUS_HTML]\"><script>alert(document.domain)</script>" ...>

9. Alternative Approaches

• Other Blocks: If woolentor/product-grid is patched or behaves differently, try other Product Grid variants like woolentor/product-grid-modern.
• Attribute Breakout: If the blockUniqId is rendered inside a JavaScript block (e.g., var config = {"id": "blockUniqId"};), use a payload like: "; alert(1); //.
• UI-Based Injection: If the REST API is restricted, use the browser_type tool to manually enter the payload into the "Unique ID" field in the Gutenberg block settings sidebar for the Product Grid block.