CVE-2026-6255 — Cross-Site Scripting (XSS)

title: WordPress Simple Owl Shortcodes Stored XSS via owls_wrapper num attribute — CVE-2026-6255
id: scw-2026-05-05-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-6255 by injecting script tags or alert functions within the 'num' attribute of the 'owls_wrapper' shortcode in the WordPress Simple Owl Shortcodes plugin. This rule targets the stored XSS payload as it might be written to the webserver logs when the shortcode is processed or rendered.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6255/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - 'owls_wrapper'
          - 'num='
      cs-uri-query|contains:
          - '<script>'
          - 'alert('
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse