CVE-2025-22558

Executive Summary

CVE-2025-22558 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin mcjh-button-shortcode by Marcus C. J. Hartmann, affecting versions up to and including 1.6.4. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the WordPress site. This injected script executes in the context of any user viewing the affected page, leading to session hijacking, defacement, or redirection to malicious sites. The CVSS v3.1 base score is 6.5 (Medium), with a vector emphasizing network access, low attack complexity, required privileges, user interaction, and a changed scope. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed through the official WordPress plugin repository. As such, it represents a supply chain risk for any WordPress site using the mcjh-button-shortcode plugin. Users are advised to remove or disable the plugin until a patched version is released. No known malicious packages or typosquatting variants have been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – an attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – the victim must view the compromised page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): Low – limited impact on service availability.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for stored XSS to affect multiple users elevates the risk for sites using this plugin.

Deep Dive & Mechanics

The vulnerability exists in the mcjh-button-shortcode plugin, which provides a WordPress shortcode for embedding styled buttons. The plugin fails to sanitize or escape user-supplied attributes (e.g., url, text, color) when rendering the shortcode output. An authenticated user with the edit_posts capability (typically Contributor or higher) can craft a shortcode like:

[mcjh-button url="javascript:alert('XSS')" text="Click Me"]

When the shortcode is processed, the url attribute is directly inserted into the HTML without proper encoding, resulting in a stored XSS payload. The injected script executes in the browser of any user viewing the page or post containing the shortcode.

The vulnerable code likely resides in the plugin's main PHP file, where the shortcode handler does not apply WordPress's built-in escaping functions such as esc_url() or esc_attr().

Vulnerable vs. Patched Code

Vulnerable Code (mcjh-button-shortcode.php, version <= 1.6.4):

function mcjh_button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'url' => '#',
        'text' => 'Button',
        'color' => '#0073aa'
    ), $atts);
    return '<a href="' . $atts['url'] . '" style="background-color:' . $atts['color'] . ';">' . $atts['text'] . '</a>';
}
add_shortcode('mcjh-button', 'mcjh_button_shortcode');

Patched Code (Hypothetical Fix):

function mcjh_button_shortcode($atts) {
    $atts = shortcode_atts(array(
        'url' => '#',
        'text' => 'Button',
        'color' => '#0073aa'
    ), $atts);
    $safe_url = esc_url($atts['url']);
    $safe_text = esc_html($atts['text']);
    $safe_color = esc_attr($atts['color']);
    return '<a href="' . $safe_url . '" style="background-color:' . $safe_color . ';">' . $safe_text . '</a>';
}
add_shortcode('mcjh-button', 'mcjh_button_shortcode');

The patched version uses esc_url() for the URL, esc_html() for the text, and esc_attr() for the color attribute, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the mcjh-button-shortcode plugin (version <= 1.6.4) installed and activated.
• An authenticated user account with at least Contributor privileges.

Steps:

1. Log in to the WordPress admin panel.
2. Create a new post or page, or edit an existing one.
3. Insert the following shortcode into the content editor:

   [mcjh-button url="javascript:alert(document.cookie)" text="Click Me"]
   

4. Publish or update the post.
5. Any user viewing the post will see a button. Clicking it triggers the JavaScript alert, demonstrating the XSS.

Advanced Payload:

[mcjh-button url="\" onmouseover=\"alert('XSS')\" " text="Hover Me"]

This payload triggers the XSS on mouse hover without requiring a click.

Blue Team

Detection:

• Monitor WordPress admin logs for unusual shortcode usage, especially by low-privilege users.
• Scan posts and pages for shortcodes containing javascript:, onerror=, onmouseover=, or other event handlers.
• Use a Web Application Firewall (WAF) to block requests containing suspicious shortcode attributes.

Hunting:

• Query the WordPress database for posts containing the string [mcjh-button and inspect the attributes.
• Example SQL query:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[mcjh-button%';
  

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/mcjh-button-shortcode/mcjh-button-shortcode.php (version <= 1.6.4)
• Shortcode Pattern: [mcjh-button url="javascript:*" or [mcjh-button url="*on*="*
• Network: Outbound connections to attacker-controlled domains from the WordPress site.
• Logs: WordPress debug log entries showing unexpected shortcode processing errors.

Detection Engineering

YARA Rule

rule CVE_2025_22558_Stored_XSS {
    meta:
        description = "Detects mcjh-button-shortcode plugin files with vulnerable shortcode handling"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22558"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $vuln_func = "function mcjh_button_shortcode"
        $unsafe_url = "href=\"" . $atts['url'] . "\""
        $unsafe_color = "background-color:" . $atts['color']
    condition:
        $vuln_func and ($unsafe_url or $unsafe_color)
}

Sigma Rule

title: CVE-2025-22558 Stored XSS via mcjh-button-shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts using the mcjh-button-shortcode WordPress plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22558
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mcjh-button'
        cs-uri-query|contains|windash: 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript URLs in shortcodes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22558 - Stored XSS via mcjh-button-shortcode";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"mcjh-button"; http_client_body;
    content:"javascript:"; http_client_body;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-22558;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the mcjh-button-shortcode plugin from all WordPress installations.
2. Audit existing content: Search all posts and pages for the [mcjh-button shortcode and remove or sanitize any instances.
3. Review user accounts: Check for any unauthorized contributor-level accounts that may have been created.

Long-Term Mitigation:

• Monitor the WordPress plugin repository for an official patched version.
• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Enforce the principle of least privilege for WordPress user roles.
• Regularly update all plugins and themes.

Workaround:

• If the plugin is critical, manually patch the vulnerable file by adding escaping functions as shown in the "Patched Code" section above.

Valters IT