CVE-2025-11813

Executive Summary

CVE-2025-11813 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive iframe GoogleMap WordPress plugin, affecting all versions up to and including 1.0.2. The flaw resides in the responsive_map shortcode, where the width and height attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. When a victim visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not available on NPM, PyPI, Go, or Ruby registries. Users should verify they are not using this plugin and remove it immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level WordPress user)
• User Interaction: None (victim only needs to visit the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low (data exfiltration possible)
• Integrity Impact: Low (content injection)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access but can be exploited by low-privilege users. The impact is limited to stored XSS, which can be used for phishing, session hijacking, or defacement.

Deep Dive & Mechanics

The responsive_map shortcode is used to embed Google Maps iframes. The plugin processes the width and height attributes without proper sanitization or output escaping. An attacker can inject JavaScript payloads into these attributes, which are then stored in the WordPress database. When the shortcode is rendered, the malicious script executes in the context of the victim's browser.

Root Cause: The plugin uses echo or print to output the attribute values directly into the HTML without using esc_attr() or wp_kses().

Attack Flow:

1. Attacker logs in with contributor-level access.
2. Attacker creates or edits a post/page and inserts the responsive_map shortcode.
3. Attacker sets the width attribute to: " onmouseover="alert('XSS')" or similar.
4. The payload is stored in the database.
5. When an admin or visitor views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0.2):

function responsive_map_shortcode($atts) {
    extract(shortcode_atts(array(
        'width' => '100%',
        'height' => '400px',
    ), $atts));
    return '<iframe width="' . $width . '" height="' . $height . '" ...></iframe>';
}

Patched Code (hypothetical fix):

function responsive_map_shortcode($atts) {
    $atts = shortcode_atts(array(
        'width' => '100%',
        'height' => '400px',
    ), $atts);
    $width = esc_attr($atts['width']);
    $height = esc_attr($atts['height']);
    return '<iframe width="' . $width . '" height="' . $height . '" ...></iframe>';
}

The fix uses esc_attr() to escape the attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Responsive iframe GoogleMap plugin <= 1.0.2
• Contributor-level account or higher

Exploit Steps:

1. Log in to WordPress as a contributor.
2. Create a new post or page.
3. Insert the shortcode with a malicious payload:

   [responsive_map width="100%\" onmouseover=\"alert(document.cookie)" height="400px"]
   

4. Publish or save the post.
5. When any user (including admin) hovers over the iframe, the XSS triggers.

Alternative Payload (auto-execute):

[responsive_map width="100%\" onfocus=\"alert(1)\" autofocus=\"true" height="400px"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the responsive_map shortcode with unusual attribute values.
• Look for patterns like onmouseover, onfocus, onload, or javascript: in shortcode attributes.
• Use WAF rules to block requests containing XSS payloads in shortcode parameters.

Prevention:

• Remove the plugin immediately if not needed.
• If required, apply a virtual patch by filtering shortcode attributes via a custom plugin or theme functions.php:

  add_filter('shortcode_atts_responsive_map', function($out, $pairs, $atts) {
      $out['width'] = esc_attr($out['width']);
      $out['height'] = esc_attr($out['height']);
      return $out;
  }, 10, 3);
  

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/responsive-iframe-googlemap/responsive-iframe-googlemap.php
• Shortcode pattern: [responsive_map width="..." height="..."] with suspicious attribute values.
• Database entries: Posts/pages containing the shortcode with XSS payloads.
• Log entries: HTTP requests to /wp-admin/post.php or /wp-admin/post-new.php with shortcode parameters containing script tags or event handlers.

Detection Engineering

YARA Rule

rule CVE_2025_11813_WordPress_XSS {
    meta:
        description = "Detects stored XSS payloads in Responsive iframe GoogleMap shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11813"
    strings:
        $shortcode = /\[responsive_map\s+.*(?:width|height)\s*=\s*["'][^"']*?(?:on\w+=|javascript:|<script)/i
        $payload1 = /on\w+\s*=\s*["']/i
        $payload2 = /javascript\s*:/i
    condition:
        $shortcode and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2025-11813 WordPress Responsive iframe GoogleMap XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts via the responsive_map shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "responsive_map"
        http.url|re: "(width|height)=.*(on\w+=|javascript:|<script)"
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11813 WordPress Responsive iframe GoogleMap XSS Attempt"; flow:to_server,established; content:"responsive_map"; http_uri; pcre:"/(width|height)=.*(on\w+=|javascript:|<script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete the Responsive iframe GoogleMap plugin from all WordPress installations.
2. Scan for compromise: Check all posts and pages for injected shortcodes with suspicious attributes. Use the YARA rule above to scan the database.
3. Reset user sessions: Force logout all users to invalidate any stolen session cookies.

Long-term Fix:

• The vendor has not released a patch. Consider replacing the plugin with a secure alternative (e.g., official Google Maps block or a well-maintained plugin).
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode parameters.
• Enforce the principle of least privilege: restrict contributor-level users from using shortcodes if not necessary.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.