CVE-2025-8720

Executive Summary

CVE-2025-8720 is a Stored Cross-Site Scripting (XSS) vulnerability in the Plugin README Parser plugin for WordPress, affecting all versions up to and including 1.3.15. The flaw resides in insufficient input sanitization and output escaping of the target parameter, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Plugin README Parser plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access.
• User Interaction (UI): Required (R) – Victim must visit the injected page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While the CVSS score is 6.4, the requirement for authenticated access reduces the attack surface. However, once exploited, the stored XSS can affect all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the target parameter handling within the Plugin README Parser plugin. The plugin parses WordPress plugin readme files and renders them on the frontend. When processing the target attribute (likely used for links or anchors), it fails to properly sanitize user input and escape output. This allows an attacker with Contributor-level access (who can create or edit posts/pages) to inject malicious JavaScript.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker creates or edits a post/page and inserts a shortcode or block from the Plugin README Parser plugin.
3. Attacker sets the target parameter to a malicious payload, e.g., " onfocus="alert(1)" autofocus=".
4. The plugin stores this payload in the database without proper sanitization.
5. When a victim views the page, the payload executes in their browser context.

Root Cause: The plugin uses esc_attr() or similar functions incorrectly, or fails to apply wp_kses() or htmlspecialchars() to the target parameter before rendering.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.3.15):

// In plugin-readme-parser.php or similar
$target = $_GET['target'] ?? '';
echo '<a target="' . $target . '">Link</a>';

The $target variable is directly concatenated into HTML without sanitization.

Patched Code (hypothetical):

$target = isset($_GET['target']) ? sanitize_text_field($_GET['target']) : '';
$target = esc_attr($target);
echo '<a target="' . $target . '">Link</a>';

Or using wp_kses() to allow only safe attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual approach is required.

Prerequisites:

• WordPress instance with Plugin README Parser <= 1.3.15.
• Contributor-level account.

Steps:

1. Log in as a Contributor.
2. Create a new post.
3. Insert the plugin's shortcode, e.g., [plugin_readme_parser target="x" onfocus="alert(document.cookie)" autofocus=""].
4. Publish the post.
5. Send the post URL to a victim.

Proof-of-Concept Payload:

" onfocus="alert('XSS')" autofocus="

This payload uses the onfocus event and autofocus attribute to trigger without user interaction.

Blue Team (Detection & Hardening)

Detection:

• Monitor for posts/pages containing suspicious target attributes in shortcodes.
• Use WAF rules to block requests with onfocus, onload, or similar event handlers in target parameters.

Hardening:

• Disable the plugin until a patch is released.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/plugin-readme-parser/plugin-readme-parser.php (or similar)
• Database: Posts/pages containing shortcodes with malicious target attributes.
• Network: HTTP requests to WordPress admin with target parameter containing event handlers.
• Logs: WordPress debug logs showing wp_kses failures or unusual shortcode usage.

Detection Engineering

YARA Rule

rule CVE_2025_8720_Plugin_Readme_Parser_XSS {
    meta:
        description = "Detects malicious target parameter in Plugin README Parser plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8720"
    strings:
        $payload1 = /target\s*=\s*["'][^"']*on\w+\s*=/i
        $payload2 = /target\s*=\s*["'][^"']*autofocus\s*=/i
        $plugin_file = "plugin-readme-parser"
    condition:
        $plugin_file and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2025-8720 - Stored XSS via Plugin README Parser
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects attempts to exploit stored XSS in Plugin README Parser plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "wp-admin/post.php"
        cs-method: "POST"
        cs-uri-query|contains: "target="
        cs-uri-query|re: "on\w+\s*="
    condition: selection
falsepositives:
    - Legitimate use of target attribute with event handlers (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8720 - Stored XSS via Plugin README Parser"; flow:to_server,established; content:"target="; nocase; pcre:"/target\s*=\s*["'][^"']*on\w+\s*=/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Review and remove any posts/pages containing suspicious shortcodes.
3. Restrict Contributor-level access to only trusted users.

Long-term Fix:

• Apply input sanitization using sanitize_text_field() and output escaping using esc_attr() or wp_kses().
• Update to a patched version once released by the vendor.

Workarounds:

• Use a Web Application Firewall (WAF) to block malicious payloads.
• Implement Content Security Policy (CSP) headers: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' (adjust as needed).

Valters IT
Securing Digital Frontiers