Contributor-to-privileged-user stored XSS through Interactivity API URL binding

Summary

A Contributor can store Interactivity API context that is later bound to an anchor href. The PHP path rejects only event-like attribute names, while browser hydration applies the resulting value directly as an element attribute.

Affected Products

WordPress core 7.0.4; Interactivity API server processing and client hydration.

Affected Scope

Product

WordPress

Component

Interactivity API server processor and client runtime

Affected function

WP_Interactivity_API::data_wp_bind_processor(); data-wp-context; data-wp-bind--href; client element attribute hydration

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-79; CWE-116

Technical Summary

The server-side binding path permits a non-event URL attribute to receive attacker-controlled context data, and the client hydrates that value into an anchor href without the normal URL protocol policy. The proof is limited to a harmless same-origin marker after a reviewer click.

Prerequisites and Permissions

Authenticated Contributor-level post creation/editing; a privileged user must view the rendered content and click the affected link.

Affected Locations

wp-includes/interactivity-api/class-wp-interactivity-api.php: WP_Interactivity_API::data_wp_bind_processor(); wp-includes/js/dist/script-modules/interactivity/index.js: context resolution and element property/attribute assignment; data-wp-context and data-wp-bind--href.

Reproducible Proof

In a controlled site, a Contributor-supplied binding survived content handling and the hydrated anchor navigated to the harmless test marker after one reviewer click. The exact post body and takeover chain are withheld.

Vulnerable Code

$value = wp_interactivity_data_wp_bind_processor( $value, $context );
$element->set_attribute( &class="tok-comment">#39;href', $value );

Severity

high

Technical Analysis

WP_Interactivity_API::data_wp_bind_processor() processes data-wp-bind--* entries and sets the derived attribute after checking only the event-name prefix. The client runtime resolves the context reference and assigns the result through the element property/attribute path. A bound href can therefore retain a javascript: URL that ordinary direct-content filtering would remove.

Impact

Integrity/confidentiality impact: a Contributor can cause script execution in the origin of a privileged reviewer after the reviewer opens the affected content and performs one normal click. The supplied evidence does not prove zero-click execution, session theft, plugin installation, or RCE as a standalone issue.

Remediation

Apply the same URL protocol allow-list to bound URL attributes in PHP and in the client runtime. Validate href, src, poster, action, and formaction bindings after context resolution, and add regression tests for javascript/data URL schemes.

Timeline

• 2026-09-14Published
• 2026-09-14Advisory published
• 2026-09-14Reclassified from Critical to High: the validated impact requires a privileged reviewer click; zero-click execution and account takeover were not demonstrated.
• 2026-09-14Removed V12 label; added source paths, parameters, negative control, and observed 7.0.4 validation. Exact payload withheld.
• 2026-09-15Live

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.