Atomic Edge analysis of CVE-2026-1045 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Viet Contact WordPress plugin versions up to and including 1.3.2. The vulnerability exists in the plugin’s admin settings interface, specifically affecting the ‘ll1’, ‘ll2’, ‘ll3’, and ‘ll4’ parameters. Successful exploitation requires administrator-level permissions and only impacts WordPress multisite installations or sites where the ‘unfiltered_html’ capability is disabled.

Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping. The CWE-79 classification confirms improper neutralization of user input during web page generation. Based on WordPress plugin patterns, the vulnerable code likely processes these parameters through an admin settings page or AJAX handler without proper validation. The vulnerability description confirms the lack of sanitization, but without source code, Atomic Edge cannot confirm the exact function names or hook implementations.

Exploitation requires an authenticated attacker with administrator privileges. The attacker would navigate to the plugin’s settings page in the WordPress admin dashboard. They would submit malicious JavaScript payloads through the ‘ll1’, ‘ll2’, ‘ll3’, or ‘ll4’ parameter fields. A typical payload might be alert(document.cookie) or more sophisticated credential-stealing scripts. The stored payload executes whenever any user accesses a page containing the injected content.

Remediation requires implementing proper input sanitization and output escaping. The plugin should use WordPress core functions like sanitize_text_field() for input validation and esc_attr() or esc_html() for output escaping. For admin settings, the plugin should use the settings API with proper sanitization callbacks. The patch must validate all user-controlled parameters before storage and escape them before rendering in browser contexts.

Impact includes session hijacking, administrative account compromise, and client-side data theft. Attackers can steal administrator cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. In multisite environments, a compromised super administrator could affect all network sites. The stored nature means a single injection affects all subsequent visitors to the vulnerable page.