Description

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:33.683Z",
  "pubdate": "2026-08-20T12:16:33.683Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in B2BKing Premium versions 5.6.07 and below. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages viewed by other users. The vulnerability arises from insufficient sanitization and output encoding of user-supplied input handled by the affected software. Successful exploitation of this vulnerability can lead to severe security implications, including session hijacking, credential theft, redirection to malicious domains, and unauthorized modification or exfiltration of sensitive data within the context of the affected user's session. The risk is significantly heightened due to the lack of authentication requirements, meaning any remote attacker can initiate an exploitation vector directly over the network without possessing prior system credentials or interacting with administrative interfaces. Remediation requires updating the B2BKing Premium plugin to a patched version once available, as well as enforcing stringent input validation and output encoding mechanisms across all vulnerable parameters.",
  "technicalDetails": "The vulnerability resides within the B2BKing Premium plugin, affecting versions 5.6.07 and prior, specifically within components that process HTTP requests without proper input sanitization or context-aware output encoding. The root cause is typical of improper input handling, where user-controlled parameters are reflected directly into the Document Object Model (DOM) or rendered within HTTP response bodies without neutralizing potentially executable syntax.\nNetwork exposure is fully external, accessible over standard web protocols (HTTP/HTTPS), and requires zero authentication or privilege prerequisites. An attacker initiates the attack flow by crafting a malicious URL or HTTP request containing payload strings embedded with HTML or JavaScript tags (e.g., <script> or event handlers like onload and onerror).\nUpon transmission of the crafted payload to the vulnerable endpoint, the application processes the input and subsequently reflects it back within the server response without adequate escaping. When an unsuspecting user or administrator accesses the maliciously crafted link or views the compromised page, the browser interprets the injected string as executable script code rather than plain text.\nThe payload executes within the security context of the victim's browser session. Depending on the target's privilege level (such as a site administrator or high-privileged B2B customer), the injected script executes arbitrary DOM manipulation, accesses document.cookie to harvest active session tokens, interacts with the WordPress REST API, or performs unauthorized administrative actions on behalf of the authenticated user.\nPost-exploitation impact ranges from complete account takeover via session hijacking to defacement and persistent client-side compromise. Because the vector is unauthenticated, automated mass exploitation scripts can be deployed across internet-facing instances running vulnerable versions of the B2BKing Premium codebase."
}