[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs7DWiIekRCcIsYjEiKFyZRFYZ1nldNFvi93jvOl_Vxo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-6287","shoplentor-woocommerce-builder-for-elementor-gutenberg-authenticated-contributor-stored-cross-site-scripting-via-product","ShopLentor - WooCommerce Builder for Elementor & Gutenberg \u003C= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute","The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","woolentor-addons",null,"\u003C=3.3.8","3.3.9","medium",5.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-26 16:17:03","2026-05-27 04:29:03",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb2d75e43-cd46-4c23-bea4-3564e0334a32?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fproduct-grid\u002Feditorial.css","assets\u002Fcss\u002Fproduct-grid\u002Fmodern.css","assets\u002Fcss\u002Fwoolentor-widgets.css","includes\u002Faddons\u002Fadd_banner.php","includes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base-widget.php","includes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php","includes\u002Faddons\u002Fproduct_accordion.php","includes\u002Faddons\u002Fproduct_image_accordion.php","researched",false,3,"This research plan outlines the steps required to demonstrate a Stored Cross-Site Scripting (XSS) vulnerability in the ShopLentor plugin for WordPress. This vulnerability allows an authenticated attacker with Contributor-level permissions or higher to inject malicious scripts into pages via the `blockUniqId` attribute of ShopLentor's Product Grid Gutenberg blocks.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Authenticated (Contributor+) Stored Cross-Site Scripting (XSS)\n*   **ID:** CVE-2026-6287\n*   **Plugin:** ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (slug: `woolentor-addons`)\n*   **Affected Attribute:** `blockUniqId` within Gutenberg blocks (e.g., Product Grid).\n*   **Cause:** The plugin fails to sanitize or escape the `blockUniqId` attribute before rendering it in the HTML output. This attribute is intended to be a unique identifier (likely for CSS\u002FJS targeting) but can be manipulated by an attacker to include script tags.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** WordPress REST API for posts (`\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`) or the standard Gutenberg editor flow.\n*   **Authentication:** Requires a user with at least `Contributor` role (to create\u002Fedit posts).\n*   **Vulnerable Parameter:** The `post_content` field containing a Gutenberg block comment with a malicious `blockUniqId` attribute.\n*   **Payload Location:** Inside the JSON attributes of the ShopLentor block (e.g., `\u003C!-- wp:woolentor\u002Fproduct-grid {\"blockUniqId\":\"PAYLOAD\"} \u002F-->`).\n\n### 3. Code Flow\n1.  **Entry Point:** An attacker creates or updates a post containing a ShopLentor Gutenberg block (e.g., `woolentor\u002Fproduct-grid`). The attributes of this block are stored in the `post_content`.\n2.  **Processing:** When the post is viewed, WordPress parses the `post_content`. The ShopLentor plugin registers a `render_callback` for its blocks.\n3.  **Sink:** The PHP rendering logic (likely found in the block registration files under `includes\u002Fgutenberg\u002F` - not provided in the snippet but inferred) retrieves the `blockUniqId` attribute. It then echoes this value directly into the HTML, likely as an `id` attribute or within a script\u002Fstyle block, without using functions like `esc_attr()` or `esc_js()`.\n4.  **Execution:** The payload is rendered in the victim's browser (e.g., an administrator viewing the post), leading to script execution.\n\n### 4. Nonce Acquisition Strategy\nTo save a post via the REST API or the Gutenberg editor flow, a `wp_rest` nonce is required.\n\n1.  **Navigate to Editor:** Log in as a Contributor and navigate to the \"New Post\" page: `\u002Fwp-admin\u002Fpost-new.php`.\n2.  **Extract Nonce:** Use `browser_eval` to extract the REST nonce from the WordPress global settings object.\n    *   **JavaScript Variable:** `window.wpApiSettings.nonce`\n3.  **Alternative Nonce:** If using the standard AJAX autosave, the `_wpnonce` can be found in `window.heartbeatSettings.nonce`.\n\n### 5. Exploitation Strategy\n1.  **Authentication:** Authenticate as a `Contributor` user.\n2.  **Nonce Retrieval:** Navigate to `\u002Fwp-admin\u002Fpost-new.php` and extract the `wp_rest` nonce using `browser_eval(\"wpApiSettings.nonce\")`.\n3.  **Identify Block Name:** Based on common ShopLentor naming conventions, the block is likely `woolentor\u002Fproduct-grid`.\n4.  **Payload Construction:**\n    *   Construct a block comment: `\u003C!-- wp:woolentor\u002Fproduct-grid {\"blockUniqId\":\"\\\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\"} \u002F-->`\n    *   This payload attempts to break out of an `id` attribute (e.g., `\u003Cdiv id=\"...\">\u003Cscript>...\u003C\u002Fscript>\">`).\n5.  **Inject Payload:** Send a POST request to `\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` to create a new post.\n    *   **Method:** `POST`\n    *   **Headers:**\n        *   `X-WP-Nonce: [EXTRACTED_REST_NONCE]`\n        *   `Content-Type: application\u002Fjson`\n    *   **Body:**\n        ```json\n        {\n          \"title\": \"ShopLentor XSS Test\",\n          \"content\": \"\u003C!-- wp:woolentor\u002Fproduct-grid {\\\"blockUniqId\\\":\\\"\\\\\\\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\\\"} \u002F-->\",\n          \"status\": \"publish\"\n        }\n        ```\n6.  **Trigger XSS:** Obtain the URL of the created post and navigate to it. The script should execute immediately.\n\n### 6. Test Data Setup\n*   **Role:** Ensure a user with the `Contributor` role exists.\n*   **Plugin State:** ShopLentor version \u003C= 3.3.8 must be active.\n*   **Environment:** A standard WordPress installation with WooCommerce (as ShopLentor is a WooCommerce builder).\n\n### 7. Expected Results\n*   The REST API should return a `201 Created` status code.\n*   When viewing the post frontend, the HTML source should contain the unescaped script tag.\n*   A JavaScript alert box showing the document domain should appear.\n\n### 8. Verification Steps\n1.  **Check Post Content:** Use WP-CLI to verify the payload is stored correctly:\n    *   `wp post list --post_type=post` (find the ID)\n    *   `wp post get [ID] --field=post_content`\n2.  **Check HTML Output:** Use the `http_request` tool to fetch the post URL and search for the raw payload:\n    *   Look for `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` in the response body.\n3.  **Confirm Lack of Escaping:** Verify that the rendered HTML looks like:\n    *   `\u003Cdiv id=\"[PREVIOUS_HTML]\\\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\" ...>`\n\n### 9. Alternative Approaches\n*   **Other Blocks:** If `woolentor\u002Fproduct-grid` is patched or behaves differently, try other Product Grid variants like `woolentor\u002Fproduct-grid-modern`.\n*   **Attribute Breakout:** If the `blockUniqId` is rendered inside a JavaScript block (e.g., `var config = {\"id\": \"blockUniqId\"};`), use a payload like: `\"; alert(1); \u002F\u002F`.\n*   **UI-Based Injection:** If the REST API is restricted, use the `browser_type` tool to manually enter the payload into the \"Unique ID\" field in the Gutenberg block settings sidebar for the Product Grid block.","The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'blockUniqId' attribute (mapped to 'grid_id' in PHP) in several Product Grid components. Authenticated attackers with Contributor-level permissions or higher can inject malicious scripts that execute in the browser of any user viewing the affected page due to missing output escaping.","\u002F\u002F includes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php:538\n                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';\n\n---\n\n\u002F\u002F includes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php:541\n                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\" disabled=\"true\">';\n\n---\n\n\u002F\u002F includes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php:548\n            case 'infinite':\n                echo '\u003Cdiv class=\"woolentor-infinite-scroll\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoolentor-addons\u002F3.3.8\u002Fincludes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php\t2026-02-01 06:42:20.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwoolentor-addons\u002F3.3.9\u002Fincludes\u002Faddons\u002Fproduct-grid\u002Fbase\u002Fclass.product-grid-base.php\t2026-05-03 05:25:28.000000000 +0000\n@@ -535,18 +535,18 @@\n             case 'load_more':\n                 if ( $current_page \u003C $total_pages ) {\n                     echo '\u003Cbutton class=\"woolentor-ajax-loader\">\u003Cspan class=\"spinner\">\u003C\u002Fspan>\u003C\u002Fbutton>';\n-                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';\n+                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.esc_attr( $settings['grid_id'] ).'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';\n                     echo esc_html( $settings['load_more_text'] );\n                     echo '\u003C\u002Fbutton>';\n                 }else{\n-                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\" disabled=\"true\">';\n+                    echo '\u003Cbutton class=\"woolentor-load-more-btn\" data-complete-loadtxt=\"'.esc_attr( $settings['load_more_complete_text'] ).'\" data-grid-id=\"'.esc_attr( $settings['grid_id'] ).'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\" disabled=\"true\">';\n                     echo esc_html( $settings['load_more_complete_text'] );\n                     echo '\u003C\u002Fbutton>';\n                 }\n                 break;\n \n             case 'infinite':\n-                echo '\u003Cdiv class=\"woolentor-infinite-scroll\" data-grid-id=\"'.$settings['grid_id'].'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';\n+                echo '\u003Cdiv class=\"woolentor-infinite-scroll\" data-grid-id=\"'.esc_attr( $settings['grid_id'] ).'\" data-page=\"' . ( $current_page + 1 ) . '\" data-max-pages=\"' . $total_pages . '\">';\n                 echo '\u003Cbutton class=\"woolentor-ajax-loader\">\u003Cspan class=\"spinner\">\u003C\u002Fspan>\u003C\u002Fbutton>';\n                 echo '\u003C\u002Fdiv>';\n                 break;","To exploit this vulnerability, an attacker with at least Contributor-level access must create a new post or edit an existing one using the Gutenberg editor. The attacker adds a ShopLentor Product Grid block (e.g., `woolentor\u002Fproduct-grid`) and modifies its metadata to include a malicious payload in the `blockUniqId` attribute. This can be done via the REST API endpoint `\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` by supplying a block comment like `\u003C!-- wp:woolentor\u002Fproduct-grid {\"blockUniqId\":\"\\\">\u003Cscript>alert(1)\u003C\u002Fscript>\"} \u002F-->`. When the post is rendered, the plugin echoes the unescaped `blockUniqId` directly into the `data-grid-id` attribute of an HTML element, allowing the attacker to break out of the attribute and execute arbitrary JavaScript.","gemini-3-flash-preview","2026-06-04 19:18:14","2026-06-04 19:19:05",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.3.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoolentor-addons\u002Ftags\u002F3.3.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoolentor-addons.3.3.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoolentor-addons\u002Ftags\u002F3.3.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoolentor-addons.3.3.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoolentor-addons\u002Ftags"]