Atomic Edge analysis of CVE-2026-1099 (metadata-based):
The Administrative Shortcodes WordPress plugin contains an authenticated stored cross-site scripting vulnerability in versions up to and including 0.3.4. The vulnerability exists within the plugin’s shortcode handlers for ‘login’ and ‘logout’ attributes. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute when other users view the compromised content.

Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping. The plugin likely processes shortcode attributes without proper validation. It then directly outputs these attributes without escaping them in the rendered HTML. This inference aligns with CWE-79 classification. Without access to source code, this conclusion is based on the vulnerability description and common WordPress plugin patterns.

Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post or page. They insert a shortcode provided by the plugin, such as [admin_login] or [admin_logout]. The attacker adds malicious JavaScript payloads within the ‘login’ or ‘logout’ attribute values. For example: [admin_login login=”alert(document.cookie)”] or [admin_logout logout=”javascript:alert(1)”]. Upon saving, the payload is stored in the database. The payload executes in the browser of any user viewing that post or page.

Remediation requires implementing proper input sanitization and output escaping. The plugin should validate and sanitize all shortcode attribute values before processing. It must escape all dynamic content before outputting it to the browser. WordPress provides functions like esc_attr() for attribute contexts and wp_kses() for allowed HTML. The plugin should also implement capability checks to ensure only authorized users can edit shortcode attributes.

Successful exploitation leads to stored cross-site scripting attacks. Injected scripts execute with the privileges of the viewing user. This can result in session hijacking, account takeover, or content defacement. Attackers can steal authentication cookies, redirect users to malicious sites, or perform actions on behalf of the user. The CVSS score of 6.4 reflects medium severity with scope change, indicating the attack can impact other site components.