CVE-2025-13401

Executive Summary

CVE-2025-13401 is a Stored Cross-Site Scripting (XSS) vulnerability in the Autoptimize WordPress plugin, affecting all versions up to and including 3.1.13. The flaw resides in the create_img_preload_tag function, which handles the "LCP Image to preload" metabox. Insufficient input sanitization and output escaping on user-supplied image attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When an administrator or other user visits a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, defacement, or data theft.

This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to stored persistence and cross-site scripting.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply patches as soon as they become available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): None (N) – No user action needed for injection.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited modification possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can affect all users visiting the compromised page.

Deep Dive & Mechanics

The vulnerability exists in the create_img_preload_tag function within the Autoptimize plugin. This function is responsible for generating HTML <link> tags for preloading images, specifically for the "LCP Image to preload" metabox. The function takes user-supplied image attributes (such as src, srcset, sizes, etc.) and directly embeds them into the HTML output without proper sanitization or escaping.

An authenticated attacker with contributor-level access can craft a malicious image attribute containing JavaScript code. For example, the attacker could set the src attribute to:

" onload="alert('XSS')"

When the plugin generates the preload tag, it outputs:

<link rel="preload" as="image" href="" onload="alert('XSS')">

This script executes when the page loads, affecting any user who visits the page.

The vulnerability is stored because the malicious input is saved in the WordPress database (likely as post meta) and rendered on every subsequent page load.

Vulnerable vs. Patched Code

Vulnerable Code (Autoptimize <= 3.1.13):

function create_img_preload_tag($attributes) {
    $tag = '<link rel="preload" as="image" ';
    foreach ($attributes as $attr => $value) {
        $tag .= $attr . '="' . $value . '" ';
    }
    $tag .= '>';
    return $tag;
}

The $value is directly concatenated without escaping, allowing XSS.

Patched Code (Hypothetical):

function create_img_preload_tag($attributes) {
    $tag = '<link rel="preload" as="image" ';
    foreach ($attributes as $attr => $value) {
        $tag .= esc_attr($attr) . '="' . esc_attr($value) . '" ';
    }
    $tag .= '>';
    return $tag;
}

The esc_attr() function escapes special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with contributor-level access or higher.
2. Steps:
   • Create a new post or edit an existing one.
   • In the "LCP Image to preload" metabox, set the image URL to a malicious payload, e.g.:

     " onload="alert(document.cookie)
     

   • Save the post.
   • When any user (including admins) views the post, the script executes.

Example Payload:

" onfocus="alert(1)" autofocus="true

Note: No public exploit code is available at this time.

Blue Team (Detection & Hardening)

• Input Validation: Ensure all user-supplied attributes are sanitized using WordPress functions like esc_attr().
• Content Security Policy (CSP): Implement a strict CSP to block inline scripts.
• User Role Management: Restrict contributor-level access to trusted users only.
• Web Application Firewall (WAF): Deploy rules to detect and block XSS payloads in image attributes.

Indicators of Compromise (IOCs)

• Suspicious Post Meta: Look for autoptimize_lcp_img meta values containing HTML event handlers (e.g., onload, onerror, onfocus).
• Unusual Script Execution: Monitor for unexpected JavaScript execution on WordPress pages.
• Log Entries: Check WordPress debug logs for errors related to the create_img_preload_tag function.

Example IOC in Database:

SELECT * FROM wp_postmeta WHERE meta_key = 'autoptimize_lcp_img' AND meta_value LIKE '%onload%';

Detection Engineering

YARA Rule

rule CVE_2025_13401_Autoptimize_XSS {
    meta:
        description = "Detects stored XSS payloads in Autoptimize LCP image meta"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13401"
    strings:
        $xss_payload = /on\w+\s*=\s*['"][^'"]*['"]/ nocase
        $meta_key = "autoptimize_lcp_img"
    condition:
        $meta_key and #xss_payload > 0
}

Sigma Rule

title: CVE-2025-13401 Autoptimize Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS payloads in Autoptimize plugin post meta
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "autoptimize_lcp_img"
        meta_value|contains|all:
            - "onload"
            - "onerror"
            - "onfocus"
    condition: selection
falsepositives:
    - Legitimate use of event handlers (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13401 Autoptimize Stored XSS Payload"; flow:to_server,established; content:"autoptimize_lcp_img"; http_client_body; pcre:"/on\w+\s*=\s*['\"][^'\"]*['\"]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Autoptimize plugin until a patch is available.
2. Update: Apply the official patch from the plugin vendor as soon as it is released.
3. Workaround: Manually edit the create_img_preload_tag function to use esc_attr() on all attributes.
4. Long-term: Implement a Web Application Firewall (WAF) with XSS detection rules.
5. Monitoring: Continuously monitor for suspicious post meta values and unusual script execution.

Valters IT
Securing Digital Frontiers