Atomic Edge analysis of CVE-2026-3354 (metadata-based):
This vulnerability is an authenticated stored Cross-Site Scripting (XSS) flaw in the Wikilookup WordPress plugin, affecting all versions up to and including 1.1.5. The vulnerability exists within the ‘Popup Width’ setting, allowing attackers with administrator-level privileges or higher to inject malicious scripts. The CVSS score of 4.4 reflects its limited scope, as exploitation requires specific conditions: a multi-site WordPress installation or a single-site installation where the ‘unfiltered_html’ capability is disabled for administrators.
Atomic Edge research infers the root cause is improper input sanitization and output escaping, as classified under CWE-79. The plugin likely accepts user-supplied input for the ‘Popup Width’ setting via an administrative form or AJAX request, stores it without adequate sanitization, and later outputs the value on public pages without proper escaping. This conclusion is inferred from the CWE classification and vulnerability description, as the source code is unavailable for direct confirmation.
The exploitation method involves an authenticated attacker with administrator privileges navigating to the plugin’s settings page. The attacker would submit a malicious payload within the ‘Popup Width’ parameter. A realistic payload would be an HTML attribute escape sequence closing the existing attribute and injecting a JavaScript event handler, such as `100 onmouseover=alert(document.domain)//`. This payload would be stored in the database. The script executes in the context of any user viewing a page where the plugin renders this unsanitized width value, likely within a shortcode or frontend popup element.
Remediation requires implementing proper input validation and output escaping. The plugin should validate the ‘Popup Width’ input to ensure it contains only expected numeric values, possibly with CSS units. For output, the plugin must use appropriate WordPress escaping functions like `esc_attr()` when echoing the value into an HTML attribute context. A patch would also need to ensure any administrative AJAX endpoint or REST API handler processing this setting performs capability checks and uses nonces to prevent CSRF attacks.
Successful exploitation leads to stored XSS, allowing an attacker to perform actions within the victim’s browser session. Impact includes session hijacking, forced navigation to malicious sites, or manipulation of page content. The attack is constrained by the requirement for administrator-level access and the specific WordPress configuration where ‘unfiltered_html’ is disabled. In a multi-site network, a site administrator could exploit this against users of their own site, but not against the super admin or other network sites.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3354 (metadata-based)
# This rule blocks exploitation attempts targeting the Wikilookup plugin's 'Popup Width' XSS vulnerability.
# It assumes the plugin uses a WordPress AJAX handler with an action containing 'wikilookup'.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:1003354,phase:2,deny,status:403,chain,msg:'CVE-2026-3354 via Wikilookup AJAX Stored XSS',severity:'CRITICAL',tag:'CVE-2026-3354',tag:'wordpress',tag:'wikilookup',tag:'xss'"
SecRule ARGS_POST:action "@rx ^wikilookup" "chain"
SecRule ARGS_POST "@rx popup[_-]?width" "chain"
SecRule ARGS_POST "@rx ["'<>]|onw+s*=" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3354 - Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting
<?php
// CONFIGURATION
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Target WordPress site
$username = 'admin'; // Administrator username
$password = 'password'; // Administrator password
$payload = '100 onmouseover=alert(document.domain)//'; // XSS payload for Popup Width parameter
// ASSUMPTIONS (based on metadata)
// 1. The plugin uses a WordPress AJAX handler for saving settings, likely via wp_ajax_wikilookup_save_options or similar.
// 2. The vulnerable parameter is named 'popup_width' or similar.
// 3. A valid WordPress nonce is required for the AJAX request.
// 4. The endpoint is /wp-admin/admin-ajax.php.
// Step 1: Authenticate and obtain cookies and nonce.
// This PoC simulates the attack flow but cannot guarantee the exact AJAX action or nonce location without the plugin source.
// In a real scenario, an attacker would first log in and scrape the nonce from the plugin's settings page HTML.
echo "[!] This PoC is speculative due to unavailable plugin source code.n";
echo "[!] Actual exploitation requires identifying the correct AJAX action and nonce parameter.n";
// Returning null as the PoC cannot be reliably constructed from metadata alone.
?>
