Exploitation Research Plan: CVE-2026-57366 (WPAdverts Stored XSS)

1. Vulnerability Summary

The WPAdverts – Classifieds Plugin (versions <= 2.3.1) is vulnerable to unauthenticated stored cross-site scripting (XSS). The vulnerability exists within the "Contact Form" add-on, specifically in how it renders an advertiser's phone number when the "Reveal phone number on click" setting is enabled.

In addons/contact-form/contact-form.php, the function adext_contact_form() retrieves the adverts_phone meta-value and splits it into two parts. The second part ($ph2) is echoed directly into the data-partial attribute of an <a> tag without any sanitization or escaping (e.g., esc_attr()). An unauthenticated attacker can submit a new advertisement with a malicious phone number containing a script payload, which will execute in the context of any user (including administrators) viewing the advertisement.

2. Attack Vector Analysis

• Entry Point: The advertisement submission form, typically rendered via the [adverts_add] shortcode.
• Vulnerable Parameter: adverts_phone (submitted via POST).
• Sink: addons/contact-form/contact-form.php, line 78 (in version 2.3.1).
• Authentication: Unauthenticated (if anonymous posting is enabled, which is a common configuration).
• Preconditions:
  1. The "Contact Form" add-on must be active.
  2. The "Reveal phone number on click" setting must be enabled.
  3. The [adverts_add] shortcode must be accessible to the attacker.

3. Code Flow

1. Submission:
   • Attacker navigates to the page containing the [adverts_add] shortcode.
   • Attacker submits the form. The Adverts_Form class binds the $_POST data (processed via adverts_request(), which only applies stripslashes_deep).
   • The data is saved to the database via update_post_meta( $post_id, 'adverts_phone', $payload ).
2. Rendering:
   • A user visits the newly created advertisement page.
   • adext_contact_form( $post_id ) is triggered by the adverts_tpl_single_bottom action hook.
   • $phone = get_post_meta( $post_id, "adverts_phone", true );
   • $ph2 = substr( $phone, 3 ); (Extracts everything after the first 3 characters).
   • Sink: echo $ph2 inside the data-partial attribute:

     <a href="#" class="wpadverts-reveal-final" data-partial="<?php echo $ph2 ?>" style="display: none"></a>
     

4. Nonce Acquisition Strategy

The [adverts_add] form uses a "checksum" system for integrity rather than standard WordPress nonces for the initial form render. These values are required for successful form submission.

1. Shortcode: The plugin uses [adverts_add].
2. Setup: Use wp post create to ensure a page with this shortcode exists.
3. Extraction:
   • Use browser_navigate to visit the [adverts_add] page.
   • Use browser_eval to extract the values from the hidden inputs:
     • _wpadverts_checksum
     • _wpadverts_checksum_nonce
     • _post_id_nonce
   • Alternatively, standard browser-based form filling (browser_type) will handle these automatically.

5. Exploitation Strategy

1. Prepare Environment: Enable the Contact Form add-on and configure the "reveal" setting.
2. Submit Payload:
   • Navigate to the [adverts_add] page.
   • Fill out the required fields:
     • post_title: "Vulnerable Ad"
     • post_content: "This is a test ad."
     • adverts_person: "Attacker"
     • adverts_email: "attacker@example.com"
     • adverts_phone: 555"><script>alert(document.domain)</script>
   • Click "Preview" and then "Finish" (or submit the form directly if steps are concatenated).
3. Trigger XSS:
   • Identify the URL of the created Ad (usually returned in the final step or found via wp post list).
   • Navigate to the Ad URL.
   • The script will execute immediately on page load because the <a> tag with the payload is rendered in the HTML.

6. Test Data Setup

# 1. Enable the Contact Form add-on (usually enabled by adding to active_modules)
# This assumes the plugin handles module loading via this option
wp option update adverts_active_modules '["contact-form"]' --format=json

# 2. Configure Contact Form to reveal phone on click
wp option update adext_contact_form_config '{"show_phone":"1","reveal_on_click":"1","from_name":"","from_email":""}' --format=json

# 3. Ensure anonymous posting is allowed in main config
# (Value depends on plugin version, typically ads_list_default__allow_anonymous)
wp option get adverts_config --format=json > config.json
# Modify config.json to ensure anonymous posting is enabled, then:
# wp option update adverts_config --format=json < config.json

# 4. Create a page for the