Exploitation Research Plan - CVE-2026-2289 (Taskbuilder Stored XSS)

1. Vulnerability Summary

The Taskbuilder plugin (<= 5.0.3) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS) via the 'Block Emails' field in the plugin settings. The vulnerability exists because the plugin saves the input for ignored email addresses without proper sanitization and subsequently outputs it in the admin settings interface without adequate escaping. This allows an administrator (or a user with similar permissions) to inject arbitrary JavaScript that executes when the settings page is viewed, particularly in environments where unfiltered_html is disabled (e.g., WordPress Multi-site).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: wppm_set_page_settings (inferred from asset/js/admin.js)
• Vulnerable Field: wppm_en_ignore_emails (The "Block Emails" setting)
• Authentication Level: Administrator (required to access and save plugin settings)
• Preconditions:
  • The attacker must have Administrator-level access.
  • To demonstrate the security failure, the environment should ideally have unfiltered_html disabled (standard for Multi-site or via define('DISALLOW_UNFILTERED_HTML', true);).

3. Code Flow

1. Input Submission: In asset/js/admin.js, the function wppm_set_page_settings() is called when the settings form is saved. It gathers data from the form with ID #wppm-frm-ps using new FormData().
2. Processing: The AJAX request is sent to admin-ajax.php. The backend handler for wppm_set_page_settings (likely in an includes/admin/ file not fully provided, but referenced by the JS) saves the input for the "Block Emails" field into the WordPress option wppm_en_ignore_emails.
3. Storage: The data is stored in the wp_options table via update_option().
4. Retrieval: When an administrator navigates to the settings page (specifically the "Page Settings" tab), the plugin calls the AJAX action wppm_get_page_setings (as seen in wppm_get_page_settings() in admin.js).
5. Sink: The backend handler for wppm_get_page_setings retrieves the wppm_en_ignore_emails option and echoes it directly into the HTML response without using esc_attr() or esc_html(). The JS then injects this response into the DOM: jQuery('.wppm_setting_col2').html(response);.

4. Nonce Acquisition Strategy

The Taskbuilder settings form uses WordPress nonces for security. Since the settings are loaded dynamically via AJAX, the nonce must be extracted from the DOM after the settings view is rendered.

1. Navigate to the Taskbuilder settings page: wp-admin/admin.php?page=wppm-settings.
2. Trigger the Page Settings view by clicking the "Page Settings" tab or executing the JS: wppm_get_page_settings();.
3. Extract Nonce: Once the form #wppm-frm-ps is loaded into the container .wppm_setting_col2, use browser_eval to find the nonce field.
   • The JS localization key for the plugin is wppm_admin.
   • The nonce is likely within the form as a hidden input.

Extraction JS:

// Ensure the page settings are loaded first
wppm_get_page_settings();
// Wait briefly then extract nonce from the newly injected form
setTimeout(() => {
    const nonce = jQuery('#wppm-frm-ps input[name="_ajax_nonce"]').val() || 
                  jQuery('#wppm-frm-ps input[name="wppm_nonce"]').val();
    return nonce;
}, 1000);

5. Exploitation Strategy

1. Login as an Administrator.
2. Navigate to the settings page to initialize the session and script context.
3. Load Page Settings via AJAX to get the form.
4. Submit the Payload:
   • Action: wppm_set_page_settings
   • Payload: <script>alert(document.domain)</script>
   • HTTP Request (Playwright):

     await http_request({
         url: "http://localhost:8080/wp-admin/admin-ajax.php",
         method: "POST",
         form: {
             action: "wppm_set_page_settings",
             wppm_en_ignore_emails: 'admin@test.com",><script>alert(document.domain)</script>',
             _ajax_nonce: extracted_nonce // Obtained from step 4
         }
     });
     

5. Trigger XSS: Navigate back to the Page Settings tab. The script will execute.

6. Test Data Setup

1. Plugin Installation: Ensure Taskbuilder <= 5.0.3 is installed and active.
2. Configuration: (Optional) To strictly verify the vulnerability regardless of the unfiltered_html capability, add define( 'DISALLOW_UNFILTERED_HTML', true ); to wp-config.php.
3. User: An admin user.

7. Expected Results

• Upon saving, the AJAX response should indicate success: {"sucess_status":"1", "messege": "..."}.
• Upon reloading the Page Settings tab, the browser should trigger an alert box showing the document domain.
• The HTML source inside the "Block Emails" field in the settings UI should contain the raw, unescaped <script> tag.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the stored option:

   wp option get wppm_en_ignore_emails
   

   Confirm it contains the <script> payload.
2. UI Verification: Navigate to wp-admin/admin.php?page=wppm-settings, click "Page Settings", and observe if the payload executes or is visible in the raw HTML response of the wppm_get_page_setings AJAX call.

9. Alternative Approaches

• Payload Variation: If <script> tags are blocked by a WAF, try an attribute-based injection: admin@test.com" onfocus="alert(1)" autofocus=".
• Direct Option Update: If the AJAX action name is different, use the http_request tool to intercept the network traffic while manually clicking "Save" in the browser to identify the correct parameter names.
• Action Name Check: If wppm_set_page_settings is not the correct action, search the plugin files for add_action( 'wp_ajax_ to find all registered AJAX handlers.