CVE-2025-9378

Executive Summary

CVE-2025-9378 is a Stored Cross-Site Scripting (XSS) vulnerability in the Vayu Blocks – Website Builder for the Block Editor WordPress plugin, affecting all versions up to and including 1.3.9. The flaw resides in the Lottie block, where multiple attributes are not properly sanitized or escaped. An authenticated attacker with at least Contributor-level access can inject arbitrary web scripts into pages. When a victim (including administrators) visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is classified as medium severity (CVSS 6.4) due to the requirement for authenticated access, but the impact is amplified by the widespread use of WordPress and the plugin’s role in building dynamic content.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No patch is currently available, and the vendor (Vayu) has not released a security update. Organizations should treat this as a supply chain risk and consider disabling the plugin until a fix is provided.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the ability to inject persistent scripts that execute for any visitor makes this a significant threat for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the Lottie block, a component of the Vayu Blocks plugin that allows users to embed Lottie animations (JSON-based vector animations). The block accepts user-supplied attributes (e.g., src, loop, speed, direction) to configure the animation. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into these attributes.

Attack Flow:

1. An attacker with Contributor-level access (or higher) creates or edits a post/page using the WordPress block editor.
2. The attacker adds a Lottie block and modifies one of its attributes (e.g., src) to include a JavaScript payload, such as javascript:alert(document.cookie) or an event handler like onload=alert(1).
3. The plugin stores the malicious attribute value in the WordPress database without proper sanitization.
4. When any user (including administrators) views the page, the injected script executes in their browser context.

Root Cause: The plugin fails to apply WordPress’s built-in escaping functions (e.g., esc_attr(), esc_url(), wp_kses()) to the Lottie block attributes before rendering them in the HTML output.

Vulnerable vs. Patched Code

Vulnerable Code (v1.3.9):

// In the render callback for the Lottie block
$src = $attributes['src'];
$loop = $attributes['loop'];
$speed = $attributes['speed'];
// Directly output without escaping
echo '<div class="wp-block-vayu-lottie" data-src="' . $src . '" data-loop="' . $loop . '" data-speed="' . $speed . '"></div>';

Patched Code (Hypothetical):

// Properly escape each attribute
$src = esc_url($attributes['src']);
$loop = esc_attr($attributes['loop']);
$speed = esc_attr($attributes['speed']);
echo '<div class="wp-block-vayu-lottie" data-src="' . $src . '" data-loop="' . $loop . '" data-speed="' . $speed . '"></div>';

The patched version uses esc_url() for URLs and esc_attr() for other attributes to prevent script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with Vayu Blocks plugin v1.3.9 installed and activated.
• An account with Contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. Add a Lottie block from the block inserter.
4. In the block settings, modify the src attribute to: javascript:alert(document.cookie)
5. Alternatively, inject an event handler: " onload="alert(1)
6. Publish or save the post.
7. When any user visits the post, the script executes.

Example Payload:

<div class="wp-block-vayu-lottie" data-src="javascript:alert(document.cookie)" data-loop="true" data-speed="1"></div>

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress database for suspicious attribute values in wp_posts.post_content containing data-src="javascript: or onload= patterns.
• Use Web Application Firewall (WAF) rules to block requests containing data-src with javascript: or event handlers.

Prevention:

• Disable the Vayu Blocks plugin until a patch is available.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/vayu-blocks/ (entire plugin directory)
• Database Pattern: data-src="javascript: or onload= in wp_posts.post_content
• Network: HTTP requests to pages containing Lottie blocks with suspicious data-src values
• Logs: WordPress audit logs showing post modifications by Contributor users with unusual block attributes

Detection Engineering

YARA Rule

rule Detect_Vayu_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in Vayu Blocks Lottie block attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9378"
    strings:
        $xss1 = /data-src\s*=\s*["']javascript:/i
        $xss2 = /onload\s*=\s*["']/i
        $xss3 = /onerror\s*=\s*["']/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Vayu Blocks Lottie Block
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Vayu Blocks plugin Lottie block attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: '/wp-content/plugins/vayu-blocks/'
        http.body|contains|all:
            - 'data-src'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9378 Vayu Blocks Stored XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/vayu-blocks/"; http_uri; content:"data-src"; http_client_body; pcre:"/data-src\s*=\s*["']javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Vayu Blocks plugin until a patched version is released.
2. Review and clean any existing posts/pages that contain Lottie blocks with suspicious attributes.
3. Audit user accounts with Contributor-level access and remove unnecessary privileges.

Long-term Fix:

• The vendor (Vayu) must release a patched version that properly sanitizes and escapes all block attributes.
• Apply WordPress security best practices: use esc_attr(), esc_url(), and wp_kses() for all user-supplied data.

Workarounds:

• Implement a Web Application Firewall (WAF) rule to block requests containing data-src with javascript: or event handlers.
• Use a security plugin (e.g., Wordfence) to monitor for XSS attempts.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.