CVE-2025-13054

Executive Summary

CVE-2025-13054 is a Stored Cross-Site Scripting (XSS) vulnerability found in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress. The flaw resides in the wppb-embed shortcode, which fails to properly sanitize user-supplied attributes and escape output. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a victim (including administrators) visits a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions up to and including 3.14.8. No official patch has been released at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for WordPress sites with untrusted contributors.

WordPress Ecosystem Context

This is a WordPress plugin vulnerability. The attack surface is limited to authenticated users with Contributor roles or higher, but the impact can be severe if an attacker escalates privileges or targets site administrators.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to persistent compromise of the WordPress admin interface.

Deep Dive & Mechanics

The vulnerability is in the wppb-embed shortcode handler. The plugin registers a shortcode that accepts user-defined attributes (e.g., [wppb-embed url="..." title="..." ]). The code does not properly sanitize the url or title attributes before outputting them into the page HTML. An attacker can inject JavaScript by crafting a malicious attribute value, such as:

[wppb-embed url="javascript:alert('XSS')" title="<script>alert('XSS')</script>"]

Because the shortcode output is not escaped, the injected script becomes part of the page content and executes when the page is rendered.

The vulnerability is stored in the WordPress database (post content), meaning it persists until the malicious content is removed. Any user visiting the affected page will trigger the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function wppb_embed_shortcode($atts) {
    $url = $atts['url'];
    $title = $atts['title'];
    return '<a href="' . $url . '" title="' . $title . '">' . $title . '</a>';
}
add_shortcode('wppb-embed', 'wppb_embed_shortcode');

Patched Code (expected):

function wppb_embed_shortcode($atts) {
    $url = esc_url($atts['url']);
    $title = esc_attr($atts['title']);
    return '<a href="' . $url . '" title="' . $title . '">' . esc_html($title) . '</a>';
}
add_shortcode('wppb-embed', 'wppb_embed_shortcode');

The patched version uses esc_url() for the URL, esc_attr() for the title attribute, and esc_html() for the visible text, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: WordPress site with User Profile Builder plugin <= 3.14.8, an account with Contributor role or higher.
2. Craft Payload: Create a post or page containing the malicious shortcode:

   [wppb-embed url="http://evil.com/xss.js" title="<img src=x onerror=alert(document.cookie)>"]
   

3. Publish: Save the post as a Contributor (or higher). The shortcode will be stored in the database.
4. Trigger: When an administrator or other user visits the page, the XSS executes. The attacker can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install User Profile Builder plugin version 3.14.8.
• Create a Contributor user and log in.
• Create a new post with the malicious shortcode.
• Visit the post as an admin user to observe the XSS.

Blue Team (Defense & Detection)

• Input Validation: Ensure all shortcode attributes are sanitized using WordPress functions like esc_url(), esc_attr(), and esc_html().
• Web Application Firewall (WAF): Deploy rules to block common XSS patterns in shortcode attributes.
• Content Security Policy (CSP): Implement a strict CSP to mitigate script execution even if XSS is injected.
• User Role Management: Restrict Contributor-level access to trusted users only. Consider disabling shortcodes for lower-privileged roles.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/user-profile-builder/ (check for modified shortcode handler files)
• Database: Posts or pages containing [wppb-embed with suspicious attributes (e.g., javascript:, <script>, onerror=)
• Network: Outbound connections to attacker-controlled domains (if payload loads external scripts)
• Logs: WordPress debug logs showing unexpected shortcode parsing errors or warnings

Detection Engineering

YARA Rule

rule CVE_2025_13054_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13054"
    strings:
        $shortcode = /\[wppb-embed[^\]]*\]/ nocase
        $xss1 = /(?:javascript|vbscript|data):/i
        $xss2 = /<script[^>]*>/i
        $xss3 = /on\w+\s*=/i
    condition:
        $shortcode and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: CVE-2025-13054 Stored XSS via wppb-embed Shortcode
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS attempts using the wppb-embed shortcode in WordPress
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'wppb-embed'
        http.url|contains|any:
            - 'javascript:'
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13054 Stored XSS via wppb-embed Shortcode"; flow:to_server,established; content:"wppb-embed"; http_uri; pcre:"/(javascript|vbscript|data):/i"; pcre:"/<script[^>]*>/i"; pcre:"/on\w+\s*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the wppb-embed shortcode by adding remove_shortcode('wppb-embed'); to your theme's functions.php file.
2. Update: Monitor the plugin vendor for a patched version. Apply as soon as available.
3. Workaround: Use a WordPress security plugin (e.g., Wordfence) to block XSS attempts in shortcode attributes.
4. Audit: Review all posts/pages for existing malicious shortcode usage. Remove any suspicious content.
5. User Training: Educate content creators about the risks of XSS and safe shortcode usage.

Valters IT
DevSecOps & Cyber Threat Intelligence