Atomic Edge analysis of CVE-2026-1905 (metadata-based):
The Sphere Manager WordPress plugin contains an authenticated stored cross-site scripting vulnerability in versions up to and including 1.0.2. The vulnerability exists in the ‘show_sphere_image’ shortcode’s ‘width’ attribute. Attackers with Contributor-level permissions or higher can inject malicious scripts that execute when a user views a compromised page or post.

Atomic Edge research infers the root cause is improper input sanitization and output escaping, consistent with CWE-79. The plugin likely fails to validate or sanitize the ‘width’ attribute value before storing it in the post content. It also fails to escape the attribute value when outputting the shortcode’s HTML. These conclusions are inferred from the CWE classification and vulnerability description, as no source code diff is available for confirmation.

Exploitation requires an authenticated attacker with at least Contributor privileges. The attacker creates or edits a post/page and inserts the vulnerable shortcode with a malicious ‘width’ attribute payload. A typical payload would be: [show_sphere_image width=”100 onmouseover=alert(document.cookie)”]. The malicious script executes in visitors’ browsers when they view the compromised content. The attack vector is the WordPress post editor, not a specific AJAX endpoint.

Remediation requires implementing proper input sanitization and output escaping. The plugin should validate the ‘width’ parameter as a numeric value or CSS unit. It must sanitize the input using functions like `sanitize_text_field()` before storage. The plugin must escape the output using `esc_attr()` when rendering the HTML attribute. WordPress coding standards mandate both validation and contextual escaping.

The impact includes session hijacking, credential theft, and content defacement. Attackers can steal administrator cookies and perform actions as the victim user. Malicious scripts can redirect users to phishing sites or load cryptocurrency miners. Since the XSS is stored, a single injection affects all visitors to the compromised page. The CVSS score of 6.4 reflects medium confidentiality and integrity impacts with no availability effect.