Atomic Edge analysis of CVE-2026-57357:
The Search Atlas SEO plugin version 2.6.6 and earlier contains a Reflected Cross-Site Scripting vulnerability in the 404 monitor list table. An unauthenticated attacker can inject arbitrary web scripts via the `orderby_404` and `order_404` URL parameters. This affects the 404 monitoring functionality within the WordPress admin area.
Root Cause:
The vulnerability exists in `/metasync/404-monitor/class-metasync-404-monitor-list-table.php`. The `get_orderby()` function at line 307 directly returns `$_REQUEST[‘orderby_404’]` without any sanitization. The `get_order()` function at line 315 returns `$_REQUEST[‘order_404’]` without validation. These unsanitized values are then used in the `print_column_headers()` method at lines 322-369 to construct HTML column headers. The `$current_url` variable at line 326 was also built using raw `$_SERVER[‘HTTP_HOST’]` and `$_SERVER[‘REQUEST_URI’]`, which could include attacker-controlled input. The unsanitized `orderby_404` and `order_404` parameters appear directly in the `href` attribute of sortable column links, providing a direct injection point for JavaScript.
Exploitation:
An attacker crafts a URL containing `orderby_404` or `order_404` parameter with a malicious XSS payload. The victim must be logged into WordPress and tricked into clicking the crafted link. The query parameters would contain JavaScript such as `orderby_404=alert(1)` or `order_404=”>alert(1)`. The plugin renders these values without escaping in the 404 monitor list table output, causing the browser to execute the injected script in the context of the victim’s admin session.
Patch Analysis:
The patch applies multiple fixes at line 307 by adding `sanitize_key()` to `orderby_404`. At lines 312-316, it validates `order_404` to only allow ‘asc’ or ‘desc’ values. At line 326-328, it replaces the usage of `$_SERVER` variables with `esc_url(add_query_arg(…))` using properly sanitized `$_GET[‘page’]`. At lines 369-375, it applies `esc_html()` to `$column_display_name` and `esc_attr()` to tag attributes. These changes prevent both reflected XSS and header injection by ensuring all output is properly escaped and input is validated against expected values.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim’s browser within the WordPress admin context. This could lead to session hijacking, credential theft, administrative actions performed on behalf of the victim, and potential site compromise. The CVSS score of 6.1 reflects the need for user interaction but the potentially severe consequences.
