[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAQEccbjpG2M0eHt6crQPvC1V-nVMoQ-qnEdj8JHsVYc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57366","wpadverts-classifieds-plugin-unauthenticated-stored-cross-site-scripting","WPAdverts – Classifieds Plugin \u003C= 2.3.1 - Unauthenticated Stored Cross-Site Scripting","The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wpadverts",null,"\u003C=2.3.1","2.3.2","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:59:08",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F69fed134-0978-44ea-a8d1-cb836e07d546?source=api-prod",7,[22,23,24,25,26,27,28,29],"addons\u002Fcontact-form\u002Fcontact-form.php","addons\u002Fpayments\u002Fincludes\u002Fajax.php","includes\u002Fajax.php","includes\u002Fclass-field-autocomplete.php","includes\u002Ffunctions.php","includes\u002Fshortcodes.php","languages\u002Fwpadverts.pot","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-57366 (WPAdverts Stored XSS)\n\n## 1. Vulnerability Summary\nThe **WPAdverts – Classifieds Plugin** (versions \u003C= 2.3.1) is vulnerable to **unauthenticated stored cross-site scripting (XSS)**. The vulnerability exists within the \"Contact Form\" add-on, specifically in how it renders an advertiser's phone number when the \"Reveal phone number on click\" setting is enabled. \n\nIn `addons\u002Fcontact-form\u002Fcontact-form.php`, the function `adext_contact_form()` retrieves the `adverts_phone` meta-value and splits it into two parts. The second part (`$ph2`) is echoed directly into the `data-partial` attribute of an `\u003Ca>` tag without any sanitization or escaping (e.g., `esc_attr()`). An unauthenticated attacker can submit a new advertisement with a malicious phone number containing a script payload, which will execute in the context of any user (including administrators) viewing the advertisement.\n\n## 2. Attack Vector Analysis\n- **Entry Point:** The advertisement submission form, typically rendered via the `[adverts_add]` shortcode.\n- **Vulnerable Parameter:** `adverts_phone` (submitted via `POST`).\n- **Sink:** `addons\u002Fcontact-form\u002Fcontact-form.php`, line 78 (in version 2.3.1).\n- **Authentication:** Unauthenticated (if anonymous posting is enabled, which is a common configuration).\n- **Preconditions:**\n    1. The \"Contact Form\" add-on must be active.\n    2. The \"Reveal phone number on click\" setting must be enabled.\n    3. The `[adverts_add]` shortcode must be accessible to the attacker.\n\n## 3. Code Flow\n1. **Submission:**\n    - Attacker navigates to the page containing the `[adverts_add]` shortcode.\n    - Attacker submits the form. The `Adverts_Form` class binds the `$_POST` data (processed via `adverts_request()`, which only applies `stripslashes_deep`).\n    - The data is saved to the database via `update_post_meta( $post_id, 'adverts_phone', $payload )`.\n2. **Rendering:**\n    - A user visits the newly created advertisement page.\n    - `adext_contact_form( $post_id )` is triggered by the `adverts_tpl_single_bottom` action hook.\n    - `$phone = get_post_meta( $post_id, \"adverts_phone\", true );`\n    - `$ph2 = substr( $phone, 3 );` (Extracts everything after the first 3 characters).\n    - **Sink:** `echo $ph2` inside the `data-partial` attribute:\n      ```php\n      \u003Ca href=\"#\" class=\"wpadverts-reveal-final\" data-partial=\"\u003C?php echo $ph2 ?>\" style=\"display: none\">\u003C\u002Fa>\n      ```\n\n## 4. Nonce Acquisition Strategy\nThe `[adverts_add]` form uses a \"checksum\" system for integrity rather than standard WordPress nonces for the initial form render. These values are required for successful form submission.\n\n1. **Shortcode:** The plugin uses `[adverts_add]`.\n2. **Setup:** Use `wp post create` to ensure a page with this shortcode exists.\n3. **Extraction:**\n    - Use `browser_navigate` to visit the `[adverts_add]` page.\n    - Use `browser_eval` to extract the values from the hidden inputs:\n        - `_wpadverts_checksum`\n        - `_wpadverts_checksum_nonce`\n        - `_post_id_nonce`\n    - Alternatively, standard browser-based form filling (`browser_type`) will handle these automatically.\n\n## 5. Exploitation Strategy\n1. **Prepare Environment:** Enable the Contact Form add-on and configure the \"reveal\" setting.\n2. **Submit Payload:**\n    - Navigate to the `[adverts_add]` page.\n    - Fill out the required fields:\n        - `post_title`: \"Vulnerable Ad\"\n        - `post_content`: \"This is a test ad.\"\n        - `adverts_person`: \"Attacker\"\n        - `adverts_email`: \"attacker@example.com\"\n        - **`adverts_phone`**: `555\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n    - Click \"Preview\" and then \"Finish\" (or submit the form directly if steps are concatenated).\n3. **Trigger XSS:**\n    - Identify the URL of the created Ad (usually returned in the final step or found via `wp post list`).\n    - Navigate to the Ad URL.\n    - The script will execute immediately on page load because the `\u003Ca>` tag with the payload is rendered in the HTML.\n\n## 6. Test Data Setup\n```bash\n# 1. Enable the Contact Form add-on (usually enabled by adding to active_modules)\n# This assumes the plugin handles module loading via this option\nwp option update adverts_active_modules '[\"contact-form\"]' --format=json\n\n# 2. Configure Contact Form to reveal phone on click\nwp option update adext_contact_form_config '{\"show_phone\":\"1\",\"reveal_on_click\":\"1\",\"from_name\":\"\",\"from_email\":\"\"}' --format=json\n\n# 3. Ensure anonymous posting is allowed in main config\n# (Value depends on plugin version, typically ads_list_default__allow_anonymous)\nwp option get adverts_config --format=json > config.json\n# Modify config.json to ensure anonymous posting is enabled, then:\n# wp option update adverts_config --format=json \u003C config.json\n\n# 4. Create a page for the","The WPAdverts plugin is vulnerable to unauthenticated stored Cross-Site Scripting via the advertisement submission form. An attacker can inject malicious scripts into the phone number field which are then executed in the browser of any user viewing the advertisement when the 'Reveal phone number on click' feature is enabled.","\u002F\u002F addons\u002Fcontact-form\u002Fcontact-form.php line 52\n$phone = get_post_meta( $post_id, \"adverts_phone\", true );\n\nif( $phone ) {\n    $ph1 = substr( $phone, 0, 3 );\n    $ph2 = substr( $phone, 3 );\n}\n\n\u002F\u002F ... lines 73-78\n\u003Ca href=\"#\" class=\"wpadverts-reveal-button\" style=\"font-weight: normal; font-size:0.9rem\">\u003C?php esc_html_e( \"show phone\", \"wpadverts\" ) ?>\u003C\u002Fa>\n\u003C\u002Fstrong>\n\u003Ca href=\"#\" class=\"wpadverts-reveal-final\" data-partial=\"\u003C?php echo $ph2 ?>\" style=\"display: none\">\u003C\u002Fa>","--- addons\u002Fcontact-form\u002Fcontact-form.php\n+++ addons\u002Fcontact-form\u002Fcontact-form.php\n@@ -75,7 +75,7 @@\n                     ... \n                     \u003Ca href=\"#\" class=\"wpadverts-reveal-button\" style=\"font-weight: normal; font-size:0.9rem\">\u003C?php esc_html_e( \"show phone\", \"wpadverts\" ) ?>\u003C\u002Fa>\n                 \u003C\u002Fstrong>\n-                \u003Ca href=\"#\" class=\"wpadverts-reveal-final\" data-partial=\"\u003C?php echo $ph2 ?>\" style=\"display: none\">\u003C\u002Fa>\n+                \u003Ca href=\"#\" class=\"wpadverts-reveal-final\" data-partial=\"\u003C?php echo esc_attr( $ph2 ) ?>\" style=\"display: none\">\u003C\u002Fa>\n                 \u003Cspan class=\"adverts-icon-phone\">\u003C\u002Fspan>\n             \u003C\u002Fspan>\n             \u003C?php else: ?>","1. Identify the public advertisement submission page containing the [adverts_add] shortcode.\n2. Extract the necessary integrity tokens (_wpadverts_checksum and _wpadverts_checksum_nonce) from the hidden form fields.\n3. Submit a new advertisement via a POST request, placing the XSS payload in the 'adverts_phone' parameter (e.g., 555\\\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>).\n4. Ensure the plugin is configured with the 'Contact Form' add-on active and the 'Reveal phone number on click' setting enabled.\n5. Navigate to the permalink of the newly created advertisement. The script will execute automatically because the second part of the phone number payload is rendered directly into a data-attribute without proper attribute escaping.","gemini-3-flash-preview","2026-07-25 11:43:07","2026-07-25 11:44:38",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.3.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpadverts\u002Ftags\u002F2.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpadverts.2.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpadverts\u002Ftags\u002F2.3.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpadverts.2.3.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpadverts\u002Ftags"]