CVE-2025-13625

Executive Summary

CVE-2025-13625 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WP-SOS-Donate Donation Sidebar Plugin for WordPress, up to and including version 0.9.2. The flaw resides in the plugin’s improper handling of the $_SERVER['PHP_SELF'] parameter, which is used in constructing URLs or form actions. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary web scripts that execute in the context of a victim’s browser when the victim clicks a crafted link.

This vulnerability is classified as Reflected XSS (CWE-79) with a CVSS v3.1 base score of 6.1 (Medium). The attack vector is network-based, requires user interaction (clicking a link), and can lead to session hijacking, credential theft, or defacement. As of this report, no official patch is available, and the plugin appears to be unmaintained.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The $_SERVER['PHP_SELF'] variable is commonly used in WordPress plugin development for form actions, but when echoed without proper escaping, it becomes a vector for XSS. The plugin’s failure to use WordPress’s built-in escaping functions (e.g., esc_url(), esc_html()) is the root cause.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires user interaction but can be exploited by unauthenticated attackers. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as proof-of-concept code circulates.

Deep Dive & Mechanics

The vulnerability exists because the plugin uses $_SERVER['PHP_SELF'] in a context where it is echoed back to the user without proper sanitization or escaping. In PHP, $_SERVER['PHP_SELF'] contains the current script filename and path, but it can be manipulated by appending a trailing path or query string to the URL. For example, a request to:

http://target.com/wp-content/plugins/wp-sos-donate/some-file.php/"><script>alert('XSS')</script>

would cause $_SERVER['PHP_SELF'] to include the injected script. If the plugin outputs this value directly (e.g., in a form action attribute), the injected script executes in the victim’s browser.

Attack Flow:

1. Attacker crafts a malicious URL containing XSS payload in the path after the PHP script.
2. Victim clicks the link (e.g., via phishing email or social engineering).
3. The plugin processes the request and reflects the payload in the HTML response.
4. The victim’s browser executes the injected script, allowing the attacker to steal cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (wp-sos-donate <= 0.9.2):

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    <!-- form fields -->
</form>

Patched Code (Hypothetical):

<form action="<?php echo esc_url( $_SERVER['REQUEST_URI'] ); ?>" method="post">
    <!-- form fields -->
</form>

Or better:

<form action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post">
    <!-- form fields -->
</form>

The patched version uses esc_url() to sanitize the URL and avoids using $_SERVER['PHP_SELF'] directly. Since no official patch exists, users must manually apply these fixes or remove the plugin.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with WP-SOS-Donate plugin <= 0.9.2 active.
• Ability to craft and deliver a malicious link.

Exploit Payload:

http://target.com/wp-content/plugins/wp-sos-donate/donation-sidebar.php/"><script>alert(document.cookie)</script>

Step-by-Step:

1. Identify the vulnerable plugin file (e.g., donation-sidebar.php).
2. Craft a URL with the XSS payload appended after the script name.
3. Deliver the link to the victim via email, social media, or other channels.
4. When the victim clicks, the script executes, and the attacker can capture cookies or perform further actions.

Example using curl to test:

curl -v "http://target.com/wp-content/plugins/wp-sos-donate/donation-sidebar.php/%22%3E%3Cscript%3Ealert(1)%3C/script%3E"

Blue Team (Defender)

Detection:

• Monitor web server logs for requests containing <script> tags or encoded XSS patterns in the URL path.
• Look for unusual PHP_SELF values in access logs (e.g., paths ending with "><script>).

Mitigation:

• Apply a Web Application Firewall (WAF) rule to block requests with XSS patterns in the URL path.
• Use WordPress security plugins that enforce output escaping.
• If possible, disable or remove the vulnerable plugin until a patch is available.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "@rx <script" "id:1001,phase:1,deny,status:403,msg:'XSS Attempt Detected'"

Indicators of Compromise (IOCs)

• URL Patterns: Requests to /wp-content/plugins/wp-sos-donate/ with appended XSS payloads (e.g., "><script>alert(1)</script>).
• Log Entries: HTTP 200 responses with PHP_SELF containing script tags.
• Network Traffic: Outbound connections from victim’s browser to attacker-controlled domains (if payload exfiltrates data).
• File Hashes: No specific file hashes; the vulnerability is in the plugin’s source code.

Detection Engineering

YARA Rule

rule CVE_2025_13625_WP_SOS_Donate_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP-SOS-Donate plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-13625"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $php_self_ref = /$_SERVER\['PHP_SELF'\]/
    condition:
        $php_self_ref and $xss_payload
}

Sigma Rule

title: Reflected XSS via PHP_SELF in WP-SOS-Donate
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts targeting WP-SOS-Donate plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script'
            - '%3Cscript'
            - '><script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13625 WP-SOS-Donate Reflected XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/wp-sos-donate/"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the WP-SOS-Donate plugin until a patch is released.
2. Apply virtual patching via WAF rules to block XSS payloads in URL paths.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• The plugin developer must update the code to use esc_url() on $_SERVER['PHP_SELF'] or switch to a safer alternative like admin_url().
• Since no patch is available, consider migrating to an alternative donation plugin that is actively maintained.

User Awareness:

• Educate users not to click suspicious links, especially those containing unusual characters or script tags.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert