Description

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-01T06:17:11.577Z",
  "pubdate": "2026-10-01T06:17:11.577Z",
  "executiveSummary": "The Extendify plugin for WordPress, in versions up to and including 3.1.6, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw arises from inadequate input sanitization and output escaping within the 'styles.blocks' Block Type Key.\nThe vulnerability is critical as it allows unauthenticated remote attackers to inject malicious JavaScript payloads directly into web pages.\nBecause the vulnerable code executes prior to WordPress permission checks, attackers can successfully execute arbitrary code within the context of a victim's session when they view the compromised page.\nThis exposure presents significant risks, including unauthorized session hijacking, data exfiltration, and unauthorized actions performed on behalf of legitimate users.\nExploitation requires no prior authentication and can be triggered via standard REST API requests, making it a high-risk vector for site compromise.",
  "technicalDetails": "The root cause of this vulnerability is the insecure implementation of the registerIncoming() function within the Extendify plugin. This function is hooked into the rest_request_before_callbacks event in WordPress, which forces execution before the framework evaluates the mandatory permission_callback for specific REST API routes.\nBecause the function triggers prematurely, it processes incoming POST, PUT, or PATCH requests directed at the /wp/v2/global-styles endpoint before authentication or authorization checks are enforced by the WordPress REST API layer.\nAn attacker can craft a malicious payload targeting the 'styles.blocks' Block Type Key. Since the application fails to properly sanitize this input or apply appropriate output escaping before rendering the data, the malicious script is persisted in the database.\nThe attack flow is as follows: 1. An attacker identifies the exposed /wp/v2/global-styles REST route. 2. The attacker sends a crafted request containing an XSS payload injected into the 'styles.blocks' parameter. 3. The server-side registerIncoming() function processes the request prior to verifying the user's identity, resulting in the script being saved to the WordPress database. 4. When a user or administrator navigates to a page where these global styles are loaded, the malicious script is executed within the browser of the victim.\nThe impact of this Stored XSS is severe. Since the payload runs in the user's browser, it inherits the current user's session context. This allows attackers to perform unauthorized administrative actions, steal sensitive cookies, or redirect users to malicious domains. The fact that the vulnerability is accessible to unauthenticated users via the public-facing REST API significantly expands the attack surface, allowing for automated exploitation attempts against vulnerable WordPress installations. All versions up to 3.1.6 remain fully exposed to this unauthorized code execution path until updated to a patched version."
}