CVE-2025-10132

Executive Summary

CVE-2025-10132 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dhivehi Text plugin for WordPress, affecting all versions up to and including 0.1. The vulnerability exists in the plugin's dhivehi shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts into pages. When a user accesses an injected page, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is part of the WordPress ecosystem and does not affect the core WordPress software or server infrastructure like Apache or Nginx. The CVSS score is 6.4 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin installations and ensure they are not using compromised versions. Since no patch is available, users must consider removing or disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication, but contributor-level access is common in multi-author WordPress sites. The impact is limited to script execution in the browser, but can be chained with other attacks for greater effect.

Deep Dive & Mechanics

The vulnerability resides in the dhivehi shortcode handler. When a user inserts the shortcode [dhivehi attribute="value"] into a post or page, the plugin processes the attributes without proper sanitization or output escaping. Specifically, the attribute parameter is directly echoed into the HTML without being filtered for malicious JavaScript.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the shortcode callback function.

Attack Flow:

1. An authenticated attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts the shortcode with a malicious payload, e.g., [dhivehi attribute="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value directly into the page HTML.
4. When any user (including administrators) views the page, the script executes in their browser.

WordPress Context: This is a classic stored XSS vulnerability in a WordPress plugin. The attack surface is limited to authenticated users, but contributor-level access is often granted to multiple users in collaborative environments.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example based on description):

function dhivehi_shortcode_handler($atts) {
    $attribute = $atts['attribute'];
    return "<div class='dhivehi-text'>" . $attribute . "</div>";
}
add_shortcode('dhivehi', 'dhivehi_shortcode_handler');

Patched Code (expected fix):

function dhivehi_shortcode_handler($atts) {
    $attribute = esc_attr($atts['attribute']); // Escape attribute for safe HTML output
    return "<div class='dhivehi-text'>" . $attribute . "</div>";
}
add_shortcode('dhivehi', 'dhivehi_shortcode_handler');

The patched version uses esc_attr() to escape the attribute value, preventing XSS. Alternatively, wp_kses() could be used for more granular filtering.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with Dhivehi Text plugin v0.1 installed.
• Contributor-level account credentials.

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [dhivehi attribute="<script>alert(document.cookie)</script>"]
   

4. Publish or save the post.
5. When any user views the post, the JavaScript executes.

Advanced Payload:

[dhivehi attribute="<img src=x onerror=alert('XSS')>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for shortcode usage containing suspicious HTML/JavaScript in post content.
• Review WordPress logs for unusual shortcode patterns.
• Use WAF rules to block common XSS payloads in shortcode attributes.

Prevention:

• Disable or remove the Dhivehi Text plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/dhivehi-text/dhivehi-text.php (or similar main plugin file)
• Shortcode pattern: [dhivehi attribute="<script>...</script>"] or [dhivehi attribute="<img src=x onerror=...>"]
• HTTP Request: POST to /wp-admin/post.php with content parameter containing malicious shortcode.
• Log entry: WordPress audit log showing shortcode insertion by a contributor-level user.

Detection Engineering

YARA Rule

rule CVE_2025_10132_Dhivehi_Text_XSS {
    meta:
        description = "Detects malicious shortcode usage in Dhivehi Text plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10132"
    strings:
        $shortcode = /\[dhivehi\s+[^\]]*?(<script|<img\s+src=x\s+onerror|<svg\s+onload)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2025-10132 - Stored XSS via Dhivehi Text Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in Dhivehi Text plugin shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: '[dhivehi'
        http.body|contains|re: '(<script|<img\s+src=x\s+onerror|<svg\s+onload)'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with benign attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10132 - Stored XSS via Dhivehi Text Shortcode"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"[dhivehi"; http_client_body; pcre:"/(<script|<img\s+src=x\s+onerror|<svg\s+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Dhivehi Text plugin from all WordPress installations.
2. Audit existing content: Scan all posts and pages for malicious shortcode usage. Remove any suspicious shortcode instances.
3. Review user roles: Restrict contributor-level access to only trusted users.

Long-term Fix:

• The plugin developer must release a patched version that properly escapes shortcode attributes using esc_attr() or wp_kses().
• Until a patch is available, consider using a security plugin (e.g., Wordfence) to block XSS attempts.

Workaround:

• Implement a custom filter to strip malicious shortcode attributes:

add_shortcode('dhivehi', function($atts) {
    $attribute = esc_attr($atts['attribute']);
    return "<div class='dhivehi-text'>" . $attribute . "</div>";
});

Valters IT
DevSecOps & Cyber Threat Intelligence Division