Atomic Edge analysis of CVE-2026-1187 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the ZoomifyWP Free WordPress plugin. The vulnerability exists in the ‘zoomify’ shortcode’s ‘filename’ attribute. Attackers with Contributor-level permissions or higher can inject malicious scripts into posts or pages. These scripts execute when users view the compromised content. The CVSS score of 6.4 reflects its moderate severity, with scope change and confidentiality impacts.

The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes. Atomic Edge research infers the plugin likely uses the WordPress shortcode API to register the ‘zoomify’ shortcode. The plugin’s callback function probably directly echoes or unsafely outputs the ‘filename’ attribute value without proper escaping. The CWE-79 classification confirms this as improper neutralization of input during web page generation. Without source code, this conclusion is inferred from the vulnerability description and WordPress plugin patterns.

Exploitation requires an authenticated attacker with at least Contributor-level access. The attacker creates or edits a post or page using the WordPress editor. They insert the ‘zoomify’ shortcode with a malicious ‘filename’ attribute payload. Example payload: [zoomify filename=”alert(document.domain)”] The plugin stores this unsanitized shortcode in the database. When any user views the page, the plugin outputs the attribute value without escaping, executing the JavaScript in the victim’s browser.

Remediation requires implementing proper output escaping on the ‘filename’ attribute. The plugin should use WordPress escaping functions like esc_attr() when outputting shortcode attributes in HTML contexts. Input validation could also restrict the ‘filename’ parameter to expected file name patterns. The patched version should escape all user-controlled data before rendering it in the browser. WordPress shortcode handlers must treat all attributes as untrusted user input.

Successful exploitation allows attackers to perform actions within the victim’s browser context. Attackers can steal session cookies, redirect users to malicious sites, or modify page content. Since the vulnerability affects Contributor-level users, attackers could compromise administrator accounts viewing infected posts. The stored nature means a single injection affects all subsequent visitors. This could lead to complete site takeover if administrator credentials are captured.