Atomic Edge analysis of CVE-2026-1903 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Ravelry Designs Widget WordPress plugin, affecting all versions up to and including 1.0.0. The vulnerability exists in the ‘sb_ravelry_designs’ shortcode’s ‘layout’ attribute. Attackers with contributor-level or higher privileges can inject malicious scripts that execute when any user views a compromised page. The CVSS 3.1 score of 6.4 (Medium severity) reflects the network attack vector, low attack complexity, and scope change impact.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin likely registers the shortcode using `add_shortcode(‘sb_ravelry_designs’, …)`. The callback function probably directly echoes or prints the ‘layout’ attribute value without proper escaping via `esc_attr()` or similar WordPress security functions. This conclusion is inferred from the CWE-79 classification and the vulnerability description, as no source code diff is available for confirmation.

Exploitation requires an authenticated user with at least contributor privileges. The attacker would create or edit a post/page containing the malicious shortcode. A typical payload would be `[sb_ravelry_designs layout=”alert(document.domain)”]`. The script executes in visitors’ browsers when they view the compromised content. Attackers could also use more sophisticated payloads that steal session cookies, redirect users, or perform actions on their behalf.

Remediation requires implementing proper output escaping in the shortcode handler. The plugin should use WordPress escaping functions like `esc_attr()` for attribute values and `wp_kses()` for any HTML output. Additionally, input validation should restrict the ‘layout’ attribute to expected values if it has a limited set of valid options. A comprehensive fix would also audit all user-controlled parameters in the shortcode for similar issues.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the vulnerable WordPress site. This can lead to session hijacking, administrative actions performed by logged-in users, content defacement, or redirection to malicious sites. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect other site components beyond the plugin itself, potentially compromising the entire WordPress installation.